Re: Datbricks CLI is encoding the secrets in base ...

spearitchmeta · ‎08-21-2025

Hello Everyone,

I am using my MAc terminal to save a databricks primary key using a specific scope and secret.

Now everything runs smoothly ! except when I get to the step where I generate a secret. Problem is that my primary key is for example "test123" and when I use the following I get

"databricks secrets get-secret "caefe_prod" "cosmosdb_prod_prim_key"

Output

{

  "key":"cosmosdb_prod_prim_key",

  "value":"cGFzdGVfeW91cl9rZXlfaGVyZQ=="

}

Why is this happening? Am I missing something?

szymon_dybczak · ‎08-21-2025

Hi @spearitchmeta ,

Yes, you're right. In order to read the value of a secret using the Databricks CLI, you must decode the base64 encoded value. You can use jq to extract the value and base --decode to decode it:

databricks secrets get-secret <scope-name> <key-name> | jq -r .value | base64 --decode

Secret management | Databricks Documentation

View solution in original post

Khaja_Zaffer · ‎08-21-2025

@szymon_dybczak Exactly

Thank you. 🙂

spearitchmeta · ‎08-21-2025

@szymon_dybczak

Thank you for yor fast reponse. But the secret is still encoded in that case. Meaning that when I read the secret in databricks to access the azure resource I generally use: key = dbutils.secrets.get(scope="some-name", key="key-name")

In this case I assume that the encoded key will be read as well right? (which explains the failed connection attempt as well)

szymon_dybczak · ‎08-21-2025

Hi @spearitchmeta ,

You will get encoded secret value when you use databricks cli (version 0.205 and above).

But when you use secret utility (dbutils.secrets) it should be not encoded. So you can use it directly.

View solution in original post

spearitchmeta · ‎08-21-2025

Somehow it did not work before but now the connection is properly established ! Thank you very much

szymon_dybczak · ‎08-21-2025

No problem, cool that it worked.

Datbricks CLI is encoding the secrets in base 64 automatically