---
title: Create a recipient object for non-Databricks users using bearer tokens (Databricks-to-Open sharing) | Databricks on AWS
source: https://docs.databricks.com/aws/en/delta-sharing/create-recipient-token
ingestedAt: "2026-06-18T08:05:20.003Z"
---

This article describes how to create OpenSharing recipients who do not have access to a Unity Catalog\-enabled Databricks workspace and grant those recipients access to securely shared data using bearer tokens. This authentication flow, along with the OIDC token federation authentication flow, is called _open sharing_.

Here's how it works:

1.  As a data provider, you create the recipient object in your Unity Catalog metastore.
    
2.  When you create the recipient object, you select the bearer token method, Databricks generates a token, a credential file that includes the token, and an activation link for you to share with the recipient.
    
    The recipient object has the authentication type of `TOKEN`. You can refresh and revoke the token as needed.
    
3.  The recipient accesses the activation link, downloads the credential file, and uses the credential file to authenticate and get read access to the tables you include in the shares that you give them access to.
    

The OIDC federation flow is an alternative to the bearer token flow described in this article. It has advantages of security and convenience over the bearer token flow. For details, see [Enable Open ID Connect (OIDC) federation for OpenSharing recipients](https://docs.databricks.com/aws/en/delta-sharing/create-recipient-oidc-fed).

important

All Databricks-to-Open sharing recipient tokens issued before December 8, 2025, with expiration dates after December 8, 2026, or with no expiration date, automatically expire on December 8, 2026. If you currently use recipient tokens with long or unlimited lifetimes, review your integrations and renew tokens as needed to avoid breaking changes after this date.

## Create the recipient[​](#create-the-recipient "Direct link to create-the-recipient")

To create a recipient for Databricks-to-Open sharing, you can use Catalog Explorer, the Databricks Unity Catalog CLI, or the `CREATE RECIPIENT` SQL command in a Databricks notebook or the Databricks SQL query editor.

**Permissions required**: Metastore admin or user with the `CREATE RECIPIENT` privilege for the Unity Catalog metastore where the data you want to share is registered.

*   Catalog Explorer
*   SQL
*   CLI

1.  In your Databricks workspace, click ![Data icon.](data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjY0NTc2IDAuMzY4NDUzQzguNTEwODIgMC4xNDAwOTkgOC4yNjUzIDAgOC4wMDAwNiAwQzcuNzM0ODIgMCA3LjQ4OTMgMC4xNDAwOTkgNy4zNTQzNyAwLjM2ODQ1M0w0LjEwNDM3IDUuODY4NDVDMy45NjczNiA2LjEwMDMgMy45NjUxOCA2LjM4NzgxIDQuMDk4NjUgNi42MjE3MUM0LjIzMjEzIDYuODU1NjEgNC40ODA3NiA3IDQuNzUwMDYgN0gxMS4yNTAxQzExLjUxOTQgNyAxMS43NjggNi44NTU2MSAxMS45MDE1IDYuNjIxNzFDMTIuMDM0OSA2LjM4NzgxIDEyLjAzMjggNi4xMDAzIDExLjg5NTggNS44Njg0NUw4LjY0NTc2IDAuMzY4NDUzWk04LjAwMDA2IDIuMjI0MjZMOS45MzU3MiA1LjVINi4wNjQ0TDguMDAwMDYgMi4yMjQyNloiIGZpbGw9IiM2RjZGNkYiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjUgOS4yNUM4LjUgOC44MzU3OSA4LjgzNTc5IDguNSA5LjI1IDguNUgxNC4yNUMxNC42NjQyIDguNSAxNSA4LjgzNTc5IDE1IDkuMjVWMTQuMjVDMTUgMTQuNjY0MiAxNC42NjQyIDE1IDE0LjI1IDE1SDkuMjVDOC44MzU3OSAxNSA4LjUgMTQuNjY0MiA4LjUgMTQuMjVWOS4yNVpNMTAgMTBWMTMuNUgxMy41VjEwSDEwWiIgZmlsbD0iIzZGNkY2RiIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTEgMTEuNzVDMSA5Ljk1NTA3IDIuNDU1MDcgOC41IDQuMjUgOC41QzYuMDQ0OTMgOC41IDcuNSA5Ljk1NTA3IDcuNSAxMS43NUM3LjUgMTMuNTQ0OSA2LjA0NDkzIDE1IDQuMjUgMTVDMi40NTUwNyAxNSAxIDEzLjU0NDkgMSAxMS43NVpNNC4yNSAxMEMzLjI4MzUgMTAgMi41IDEwLjc4MzUgMi41IDExLjc1QzIuNSAxMi43MTY1IDMuMjgzNSAxMy41IDQuMjUgMTMuNUM1LjIxNjUgMTMuNSA2IDEyLjcxNjUgNiAxMS43NUM2IDEwLjc4MzUgNS4yMTY1IDEwIDQuMjUgMTBaIiBmaWxsPSIjNkY2RjZGIi8+Cjwvc3ZnPgo=) **Catalog**.
    
2.  At the top of the **Catalog** pane, click the ![Gear icon.](data:image/svg+xml;base64,[encoded data, 5356 characters]) gear icon and select **OpenSharing**.
    
    Alternatively, in the upper-right corner, click **Share > OpenSharing**.
    
3.  On the **Shared by me** tab, click **New recipient**.
    
4.  Enter the **Recipient name**
    
5.  For **Recipient type**, select **Open**.
    
6.  Select **Token**.
    
7.  (Optional) Set the **Token lifetime** expiration time (in seconds, minutes, hours, or day from recipient creation time). Leave **Set expiration** selected to set an expiration time. Tokens are valid for a maximum of one year after creation.
    
    If you select **Set expiration** and leave the field blank, the token lifetime defaults to the recipient token lifetime value set in the metastore configuration. See [Modify the recipient token lifetime](#modify-recipient-token-lifetime). For information about changing the token lifetime and rotating tokens, see [Manage recipient tokens](#rotate-credential).
    
8.  (Optional) Enter a comment.
    
9.  Click **Create**.
    
10.  Copy the activation link.
     
     Alternatively, you can get the activation link later. See [Get the activation link](#get-activation-link).
     
11.  (Optional) Create custom **Recipient properties**.
     
     On the recipient **Overview** tab, click the ![Edit icon](data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAABIAAAASCAYAAABWzo5XAAABWWlDQ1BJQ0MgUHJvZmlsZQAAKJFtkL1Lw1AUxU9rasUvHHQQOgREsFKlxIJdawcpOIRq/ZpM05iqafqaRtTVVWdnJ/8CpYqLbu6Ciojo5uKkZLEl3teqadX7uJwfl/Me9x3ALyiMGQKAgmlb6ekpcXFpWQy+oJ1OBwYRUNQyS8jyDFnwra3l3MDH9XqMv3X6GFp/Ni6jD68npaqeyvz1t1RnTiurpFXqUZVZNuAbIZa3bMZ5m7jfoqWI9znrDT7knG3wcd0zl04SXxH3qXklR3xHHMk2zfUmLhib6tcOfPtuzczMkvZShyAjAQmTiCOJecrmf2+s7k2iCIYdWFiDjjxsiHSb0TGgEadgQsU4IsQSotQxnvHv7LxZaQOIvwP+IW+2Qpmc7QEDYW82TH/p2QXOn5hiKT+J+hyhvDohNbirAgQOXPdtAQiGgdqt635UXLd2BLTdAxfOJ9PYYx56edxFAAAAOGVYSWZNTQAqAAAACAABh2kABAAAAAEAAAAaAAAAAAACoAIABAAAAAEAAAASoAMABAAAAAEAAAASAAAAALlhkG8AAAD2SURBVDgRpZM9EoIwEEYDw0l0xgKuoR0tXkFrC1vxAvaewdbOc0DBjF5F86LLBIhA4Jsh//vY3WyCt5by1O3+UEX1UslqobJ0Y6wjT4bKL1dVVk9jJj0wL5BA4tXSeINnfGg0yIbkh50xjnVoZ+0hYYZmZaARCMfIi6jUAMTaoEcCIRxyIqEAkDE5CvpuzYYQTqFBhGLrpNcT/ZO/obUhGGMg181cIIydIBeEw/Yt2RAnaAqkA5oKaYDmQGrQXIgBkUDqgzqRimWjL7HstxVS3mgOBPvO9ft6AgTVT2S7P35Xfm27ThqbjklkP0LZz9K1qWKZj+k/LRuwBP9tGQAAAAAASUVORK5CYII=) edit icon next to **Recipient properties**. Then add a property name (**Key**) and **Value**. For details, see [Manage recipient properties](https://docs.databricks.com/aws/en/delta-sharing/manage-recipients#properties).
     

The recipient is created with the `authentication_type` of `TOKEN`.

## Get the activation link[​](#get-the-activation-link "Direct link to get-the-activation-link")

To get the new recipient's activation link, you can use Catalog Explorer, the Databricks Unity Catalog CLI, or the `DESCRIBE RECIPIENT` SQL command in a Databricks notebook or the Databricks SQL query editor.

If the recipient has already downloaded the credential file, the activation link is not returned or displayed.

**Permissions required**: Metastore admin, user with the `USE RECIPIENT` privilege, or the recipient object owner.

*   Catalog Explorer
*   SQL
*   CLI

1.  In your Databricks workspace, click ![Data icon.](data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjY0NTc2IDAuMzY4NDUzQzguNTEwODIgMC4xNDAwOTkgOC4yNjUzIDAgOC4wMDAwNiAwQzcuNzM0ODIgMCA3LjQ4OTMgMC4xNDAwOTkgNy4zNTQzNyAwLjM2ODQ1M0w0LjEwNDM3IDUuODY4NDVDMy45NjczNiA2LjEwMDMgMy45NjUxOCA2LjM4NzgxIDQuMDk4NjUgNi42MjE3MUM0LjIzMjEzIDYuODU1NjEgNC40ODA3NiA3IDQuNzUwMDYgN0gxMS4yNTAxQzExLjUxOTQgNyAxMS43NjggNi44NTU2MSAxMS45MDE1IDYuNjIxNzFDMTIuMDM0OSA2LjM4NzgxIDEyLjAzMjggNi4xMDAzIDExLjg5NTggNS44Njg0NUw4LjY0NTc2IDAuMzY4NDUzWk04LjAwMDA2IDIuMjI0MjZMOS45MzU3MiA1LjVINi4wNjQ0TDguMDAwMDYgMi4yMjQyNloiIGZpbGw9IiM2RjZGNkYiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjUgOS4yNUM4LjUgOC44MzU3OSA4LjgzNTc5IDguNSA5LjI1IDguNUgxNC4yNUMxNC42NjQyIDguNSAxNSA4LjgzNTc5IDE1IDkuMjVWMTQuMjVDMTUgMTQuNjY0MiAxNC42NjQyIDE1IDE0LjI1IDE1SDkuMjVDOC44MzU3OSAxNSA4LjUgMTQuNjY0MiA4LjUgMTQuMjVWOS4yNVpNMTAgMTBWMTMuNUgxMy41VjEwSDEwWiIgZmlsbD0iIzZGNkY2RiIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTEgMTEuNzVDMSA5Ljk1NTA3IDIuNDU1MDcgOC41IDQuMjUgOC41QzYuMDQ0OTMgOC41IDcuNSA5Ljk1NTA3IDcuNSAxMS43NUM3LjUgMTMuNTQ0OSA2LjA0NDkzIDE1IDQuMjUgMTVDMi40NTUwNyAxNSAxIDEzLjU0NDkgMSAxMS43NVpNNC4yNSAxMEMzLjI4MzUgMTAgMi41IDEwLjc4MzUgMi41IDExLjc1QzIuNSAxMi43MTY1IDMuMjgzNSAxMy41IDQuMjUgMTMuNUM1LjIxNjUgMTMuNSA2IDEyLjcxNjUgNiAxMS43NUM2IDEwLjc4MzUgNS4yMTY1IDEwIDQuMjUgMTBaIiBmaWxsPSIjNkY2RjZGIi8+Cjwvc3ZnPgo=) **Catalog**.
    
2.  At the top of the **Catalog** pane, click the ![Gear icon.](data:image/svg+xml;base64,[encoded data, 5356 characters]) gear icon and select **OpenSharing**.
    
    Alternatively, in the upper-right corner, click **Share > OpenSharing**.
    
3.  On the **Shared by me** tab, click **Recipients**, and select the recipient.
    
4.  On the recipient details page, copy the **Activation link**.
    

Once you've created the recipient and [created shares](https://docs.databricks.com/aws/en/delta-sharing/create-share), you can grant the recipient access to those shares.

To grant share access to recipients, you can use Catalog Explorer, the Databricks Unity Catalog CLI, or the `GRANT ON SHARE` SQL command in a Databricks notebook or the Databricks SQL query editor.

**Permissions required**: One of the following:

*   Metastore admin.
*   Delegated permissions or ownership on both the share and the recipient objects ((`USE SHARE` + `SET SHARE PERMISSION`) or share owner) AND (`USE RECIPIENT` or recipient owner).

For instructions, see [Manage access to OpenSharing data shares (for providers)](https://docs.databricks.com/aws/en/delta-sharing/grant-access).

## Send the recipient their connection information[​](#send-the-recipient-their-connection-information "Direct link to send-the-recipient-their-connection-information")

You must let the recipient know how to access the data that you are sharing with them. Use a secure channel to share the [activation link](#get-activation-link) and a link to [instructions for using it](https://docs.databricks.com/aws/en/delta-sharing/recipient#get-access-open).

You can download the credential file only once. Recipients should treat the downloaded credential as a secret and must not share it outside of their organization. If you have concerns that a credential may have been handled insecurely, you can [rotate a recipient's credential](#rotate-credential) at any time. For more information about managing credentials to ensure secure recipient access, see [Security considerations for tokens](#security-considerations).

## Manage recipient tokens[​](#manage-recipient-tokens "Direct link to manage-recipient-tokens")

If you are sharing data with a recipient using the Databricks-to-Open sharing bearer token flow, you may need to rotate that recipient's token. Rotating a token consists of setting an existing token to expire and replacing it with a new token and activation URL.

You should rotate a recipient's token and generate a new activation URL in the following circumstances:

*   When the existing recipient token is about to expire.
*   If a recipient loses their activation URL or if it is compromised.
*   If the credential is corrupted, lost, or compromised after it is downloaded by a recipient.
*   When you modify the recipient token lifetime for a metastore. See [Modify the recipient token lifetime](#modify-recipient-token-lifetime).

### Security considerations for tokens[​](#security-considerations-for-tokens "Direct link to security-considerations-for-tokens")

At any given time, a recipient can have at most two tokens: an active token and a rotated token. The rotated token is one that has been set to expire and be replaced by the active token. Until the rotated token expires, attempting to rotate the token again results in an error.

When you rotate a recipient's token, you can optionally set `--existing-token-expire-in-seconds` to the number of seconds before the existing recipient token—that is, the one to be rotated—expires. If you set the value to `0`, the existing recipient token expires immediately.

Databricks recommends that you set `--existing-token-expire-in-seconds` to a relatively short period that gives the recipient organization time to access the new activation URL while minimizing the amount of time that the recipient has two active tokens. If you suspect that the existing recipient token is compromised, Databricks recommends that you force it to expire immediately.

If a recipient's existing activation URL has never been accessed, rotating the existing token invalidates that activation URL and replaces it with a new one.

If all recipient tokens have expired, rotating the token replaces the existing activation URL with a new one. Databricks recommends that you promptly rotate or drop a recipient whose token has expired.

If a recipient activation URL is inadvertently sent to the wrong person or is sent over an insecure channel, Databricks recommends that you:

1.  [Revoke the recipient's access to the share](https://docs.databricks.com/aws/en/delta-sharing/grant-access#revoke).
2.  Rotate the recipient and set `--existing-token-expire-in-seconds` to `0`.
3.  Share the new activation URL with the intended recipient over a secure channel.
4.  After the activation URL has been accessed, grant the recipient access to the share again.

In extreme situations, instead of rotating the recipient's token, you can [drop](https://docs.databricks.com/aws/en/delta-sharing/manage-recipients#delete-recipient) and re-create the recipient.

### Rotate a recipient's token[​](#rotate-a-recipients-token "Direct link to rotate-a-recipients-token")

To rotate a recipient's token, you can use Catalog Explorer or the Databricks Unity Catalog CLI.

**Permissions required**: Recipient object owner.

note

After you share the new activation link, the recipient must apply the new credential on their side. If the recipient imported the credential as a provider object in Unity Catalog, they must update the provider object with the Databricks REST API. See [Rotate credentials for open recipients](https://docs.databricks.com/aws/en/delta-sharing/manage-provider#rotate-credentials).

*   Catalog Explorer
*   CLI

1.  In your Databricks workspace, click ![Data icon.](data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjY0NTc2IDAuMzY4NDUzQzguNTEwODIgMC4xNDAwOTkgOC4yNjUzIDAgOC4wMDAwNiAwQzcuNzM0ODIgMCA3LjQ4OTMgMC4xNDAwOTkgNy4zNTQzNyAwLjM2ODQ1M0w0LjEwNDM3IDUuODY4NDVDMy45NjczNiA2LjEwMDMgMy45NjUxOCA2LjM4NzgxIDQuMDk4NjUgNi42MjE3MUM0LjIzMjEzIDYuODU1NjEgNC40ODA3NiA3IDQuNzUwMDYgN0gxMS4yNTAxQzExLjUxOTQgNyAxMS43NjggNi44NTU2MSAxMS45MDE1IDYuNjIxNzFDMTIuMDM0OSA2LjM4NzgxIDEyLjAzMjggNi4xMDAzIDExLjg5NTggNS44Njg0NUw4LjY0NTc2IDAuMzY4NDUzWk04LjAwMDA2IDIuMjI0MjZMOS45MzU3MiA1LjVINi4wNjQ0TDguMDAwMDYgMi4yMjQyNloiIGZpbGw9IiM2RjZGNkYiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjUgOS4yNUM4LjUgOC44MzU3OSA4LjgzNTc5IDguNSA5LjI1IDguNUgxNC4yNUMxNC42NjQyIDguNSAxNSA4LjgzNTc5IDE1IDkuMjVWMTQuMjVDMTUgMTQuNjY0MiAxNC42NjQyIDE1IDE0LjI1IDE1SDkuMjVDOC44MzU3OSAxNSA4LjUgMTQuNjY0MiA4LjUgMTQuMjVWOS4yNVpNMTAgMTBWMTMuNUgxMy41VjEwSDEwWiIgZmlsbD0iIzZGNkY2RiIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTEgMTEuNzVDMSA5Ljk1NTA3IDIuNDU1MDcgOC41IDQuMjUgOC41QzYuMDQ0OTMgOC41IDcuNSA5Ljk1NTA3IDcuNSAxMS43NUM3LjUgMTMuNTQ0OSA2LjA0NDkzIDE1IDQuMjUgMTVDMi40NTUwNyAxNSAxIDEzLjU0NDkgMSAxMS43NVpNNC4yNSAxMEMzLjI4MzUgMTAgMi41IDEwLjc4MzUgMi41IDExLjc1QzIuNSAxMi43MTY1IDMuMjgzNSAxMy41IDQuMjUgMTMuNUM1LjIxNjUgMTMuNSA2IDEyLjcxNjUgNiAxMS43NUM2IDEwLjc4MzUgNS4yMTY1IDEwIDQuMjUgMTBaIiBmaWxsPSIjNkY2RjZGIi8+Cjwvc3ZnPgo=) **Catalog**.
    
2.  At the top of the **Catalog** pane, click the ![Gear icon.](data:image/svg+xml;base64,[encoded data, 5356 characters]) gear icon and select **OpenSharing**.
    
    Alternatively, in the upper-right corner, click **Share > OpenSharing**.
    
3.  In the left pane, expand the **OpenSharing** menu and select **Shared by me**.
    
4.  On the **Shared by me** tab, click **Recipients**, and select the recipient.
    
5.  In the rightmost column, under **Token management**, next to **Token expiration**, click **Rotate**.
    
6.  On the **Rotate token** dialog, set the token to expire either immediately or for a set period of time. For advice about when to expire existing tokens, see [Security considerations for tokens](#security-considerations).
    
7.  Click **Rotate**.
    
8.  On the **Details** tab, copy the new **Activation link** and share it with the recipient over a secure channel. See [Get the activation link](#get-activation-link).
    

### Update recipient token lifetime[​](#update-recipient-token-lifetime "Direct link to update-recipient-token-lifetime")

To update the lifetime of an existing recipient token, use Catalog Explorer.

**Permissions required**: Recipient object owner.

1.  In your Databricks workspace, click ![Data icon.](data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjY0NTc2IDAuMzY4NDUzQzguNTEwODIgMC4xNDAwOTkgOC4yNjUzIDAgOC4wMDAwNiAwQzcuNzM0ODIgMCA3LjQ4OTMgMC4xNDAwOTkgNy4zNTQzNyAwLjM2ODQ1M0w0LjEwNDM3IDUuODY4NDVDMy45NjczNiA2LjEwMDMgMy45NjUxOCA2LjM4NzgxIDQuMDk4NjUgNi42MjE3MUM0LjIzMjEzIDYuODU1NjEgNC40ODA3NiA3IDQuNzUwMDYgN0gxMS4yNTAxQzExLjUxOTQgNyAxMS43NjggNi44NTU2MSAxMS45MDE1IDYuNjIxNzFDMTIuMDM0OSA2LjM4NzgxIDEyLjAzMjggNi4xMDAzIDExLjg5NTggNS44Njg0NUw4LjY0NTc2IDAuMzY4NDUzWk04LjAwMDA2IDIuMjI0MjZMOS45MzU3MiA1LjVINi4wNjQ0TDguMDAwMDYgMi4yMjQyNloiIGZpbGw9IiM2RjZGNkYiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjUgOS4yNUM4LjUgOC44MzU3OSA4LjgzNTc5IDguNSA5LjI1IDguNUgxNC4yNUMxNC42NjQyIDguNSAxNSA4LjgzNTc5IDE1IDkuMjVWMTQuMjVDMTUgMTQuNjY0MiAxNC42NjQyIDE1IDE0LjI1IDE1SDkuMjVDOC44MzU3OSAxNSA4LjUgMTQuNjY0MiA4LjUgMTQuMjVWOS4yNVpNMTAgMTBWMTMuNUgxMy41VjEwSDEwWiIgZmlsbD0iIzZGNkY2RiIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTEgMTEuNzVDMSA5Ljk1NTA3IDIuNDU1MDcgOC41IDQuMjUgOC41QzYuMDQ0OTMgOC41IDcuNSA5Ljk1NTA3IDcuNSAxMS43NUM3LjUgMTMuNTQ0OSA2LjA0NDkzIDE1IDQuMjUgMTVDMi40NTUwNyAxNSAxIDEzLjU0NDkgMSAxMS43NVpNNC4yNSAxMEMzLjI4MzUgMTAgMi41IDEwLjc4MzUgMi41IDExLjc1QzIuNSAxMi43MTY1IDMuMjgzNSAxMy41IDQuMjUgMTMuNUM1LjIxNjUgMTMuNSA2IDEyLjcxNjUgNiAxMS43NUM2IDEwLjc4MzUgNS4yMTY1IDEwIDQuMjUgMTBaIiBmaWxsPSIjNkY2RjZGIi8+Cjwvc3ZnPgo=) **Catalog**.
    
2.  At the top of the **Catalog** pane, click the ![Gear icon.](data:image/svg+xml;base64,[encoded data, 5356 characters]) gear icon and select **OpenSharing**.
    
    Alternatively, in the upper-right corner, click **Share > OpenSharing**.
    
3.  In the left pane, expand the **OpenSharing** menu and select **Shared by me**.
    
4.  On the **Shared by me** tab, click **Recipients**, and select the recipient.
    
5.  In the rightmost column, under **Token management**, next to **Token expiration**, click **Update**.
    
6.  On the **Edit recipient token lifetime** dialog, set the new token lifetime. For advice about when to expire existing tokens, see [Security considerations for tokens](#security-considerations).
    
7.  Click **Save**.
    

### Modify the recipient token lifetime[​](#modify-the-recipient-token-lifetime "Direct link to modify-the-recipient-token-lifetime")

If you need to modify the default recipient token lifetime for your Unity Catalog metastore, you can use Catalog Explorer or the Databricks Unity Catalog CLI.

note

The recipient token lifetime for existing recipients is not updated automatically when you change the default recipient token lifetime for a metastore. In order to apply the new token lifetime to a given recipient, you must rotate their token. See [Manage recipient tokens](#rotate-credential).

**Permissions required**: Account admin.

*   Catalog Explorer
*   CLI

1.  Log in to the [account console](https://accounts.cloud.databricks.com/).
2.  In the sidebar, click ![Data icon.](data:image/svg+xml;base64,PHN2ZyB3aWR0aD0iMTYiIGhlaWdodD0iMTYiIHZpZXdCb3g9IjAgMCAxNiAxNiIgZmlsbD0ibm9uZSIgeG1sbnM9Imh0dHA6Ly93d3cudzMub3JnLzIwMDAvc3ZnIj4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjY0NTc2IDAuMzY4NDUzQzguNTEwODIgMC4xNDAwOTkgOC4yNjUzIDAgOC4wMDAwNiAwQzcuNzM0ODIgMCA3LjQ4OTMgMC4xNDAwOTkgNy4zNTQzNyAwLjM2ODQ1M0w0LjEwNDM3IDUuODY4NDVDMy45NjczNiA2LjEwMDMgMy45NjUxOCA2LjM4NzgxIDQuMDk4NjUgNi42MjE3MUM0LjIzMjEzIDYuODU1NjEgNC40ODA3NiA3IDQuNzUwMDYgN0gxMS4yNTAxQzExLjUxOTQgNyAxMS43NjggNi44NTU2MSAxMS45MDE1IDYuNjIxNzFDMTIuMDM0OSA2LjM4NzgxIDEyLjAzMjggNi4xMDAzIDExLjg5NTggNS44Njg0NUw4LjY0NTc2IDAuMzY4NDUzWk04LjAwMDA2IDIuMjI0MjZMOS45MzU3MiA1LjVINi4wNjQ0TDguMDAwMDYgMi4yMjQyNloiIGZpbGw9IiM2RjZGNkYiLz4KPHBhdGggZmlsbC1ydWxlPSJldmVub2RkIiBjbGlwLXJ1bGU9ImV2ZW5vZGQiIGQ9Ik04LjUgOS4yNUM4LjUgOC44MzU3OSA4LjgzNTc5IDguNSA5LjI1IDguNUgxNC4yNUMxNC42NjQyIDguNSAxNSA4LjgzNTc5IDE1IDkuMjVWMTQuMjVDMTUgMTQuNjY0MiAxNC42NjQyIDE1IDE0LjI1IDE1SDkuMjVDOC44MzU3OSAxNSA4LjUgMTQuNjY0MiA4LjUgMTQuMjVWOS4yNVpNMTAgMTBWMTMuNUgxMy41VjEwSDEwWiIgZmlsbD0iIzZGNkY2RiIvPgo8cGF0aCBmaWxsLXJ1bGU9ImV2ZW5vZGQiIGNsaXAtcnVsZT0iZXZlbm9kZCIgZD0iTTEgMTEuNzVDMSA5Ljk1NTA3IDIuNDU1MDcgOC41IDQuMjUgOC41QzYuMDQ0OTMgOC41IDcuNSA5Ljk1NTA3IDcuNSAxMS43NUM3LjUgMTMuNTQ0OSA2LjA0NDkzIDE1IDQuMjUgMTVDMi40NTUwNyAxNSAxIDEzLjU0NDkgMSAxMS43NVpNNC4yNSAxMEMzLjI4MzUgMTAgMi41IDEwLjc4MzUgMi41IDExLjc1QzIuNSAxMi43MTY1IDMuMjgzNSAxMy41IDQuMjUgMTMuNUM1LjIxNjUgMTMuNSA2IDEyLjcxNjUgNiAxMS43NUM2IDEwLjc4MzUgNS4yMTY1IDEwIDQuMjUgMTBaIiBmaWxsPSIjNkY2RjZGIi8+Cjwvc3ZnPgo=) **Catalog**.
3.  Click the metastore name.
4.  Under **OpenSharing recipient token lifetime**, click **Edit**.
5.  Enable **Set expiration**.
6.  Enter a number of seconds, minutes, hours, or days, and select the unit of measure. Tokens are valid for a maximum of one year after creation.
7.  Click **Save**.

## Additional resources[​](#additional-resources "Direct link to Additional resources")

*   [Manage access to OpenSharing data shares (for providers)](https://docs.databricks.com/aws/en/delta-sharing/grant-access)
*   [Manage data recipients for OpenSharing](https://docs.databricks.com/aws/en/delta-sharing/manage-recipients)
*   [Restrict OpenSharing recipient access using IP access lists (Databricks-to-Open sharing)](https://docs.databricks.com/aws/en/delta-sharing/access-list)
