Hi @yustus ,

The AccountClient in the Databricks Python SDK exposes service_principal_secrets, which lets administrators create and manage OAuth secrets for service principals. The generated secrets can then be used to obtain OAuth access tokens for accessing both Databricks Account and Workspace APIs.

from databricks.sdk import AccountClient

a = AccountClient(
    host="https://accounts.azuredatabricks.net",
    account_id="<your-account-id>",
    client_id="<admin-sp-client-id>",
    client_secret="<admin-sp-secret>"
)

# Create SP
sp = a.service_principals.create(display_name="my-automation-sp")

# Create OAuth secret for it
secret = a.service_principal_secrets.create(service_principal_id=str(sp.id))

print(f"Client ID: {sp.application_id}")
print(f"Secret: {secret.secret}")  # Store this securely — shown only once!

You can also use terraform:

resource "databricks_service_principal" "sp" {
  provider     = databricks.account
  display_name = "my-automation-sp"
}

resource "databricks_service_principal_secret" "sp_secret" {
  service_principal_id = databricks_service_principal.sp.id
  lifetime             = "15552000s" # 180 days
}

If my answer was helpful, please consider marking it as accepted solution.