Installing App from Marketplace

[GvReddy]

Hi All,

I'm using the free edition and I'm trying to install a free app from the Marketplace. After the installation, it's asking me to provide secrets.

Could you please guide me on where I can obtain these secrets? Do I need to get them from the app owner/developer, or is there another way to generate or access them?

Thanks in advance for your help!

[ThomazNeto]

Good question, and the answer is usually simpler than it looks: those secrets are almost always YOUR OWN credentials for whatever third-party service the app talks to — not something the developer sends you.

Here's the model: Marketplace apps aren't allowed to ship with API keys baked in. Anything like an OpenAI key, a Stripe key, or a database credential is declared as a secret *resource* in the app, and at install time it binds to a secret scope that YOU own and populate. Each consumer uses their own provider account — that's deliberate, for billing and quota isolation. So:

1. First, check the app's Marketplace listing / install instructions. Providers are expected to document exactly which secrets you must supply and where to obtain them (e.g. "an OpenAI API key from platform.openai.com"). If the listing doesn't say, that's a question for the provider via the listing's contact — and honestly a gap in their docs worth flagging.

2. Obtain the credential from that third-party service using your own account. You'd only get a secret from the app developer in one case: if it's a license key they issue for their own service.

3. Put it in a Databricks secret scope. Easiest via the CLI:

databricks secrets create-scope my-app-scope
databricks secrets put-secret my-app-scope my-key-name

(it prompts for the value; on Free Edition, authenticate the CLI with databricks auth login first)

4. Back in the app's Configure step → App resources → the secret resource → pick your scope and key. On deploy, Databricks injects it into the app as an environment variable — the value never appears in the app's code or config.

One security tip that matters more than it looks: create a DEDICATED scope for this app with only the secrets it needs. Permissions are granted at the scope level, not per secret — so an app with "Can read" on a scope can read EVERY secret in it. A marketplace app you didn't write shouldn't share a scope with anything else.