---
type: concept
x-llmwiki:
  schemaVersion: "0.1"
  contentHash: 79fc4bed5a11427a25117511ccc78497a07177bb37cd70b9ea221f6589dcf223
  pageDirectory: concepts
  sources:
    - create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md
  confidence: 1
  provenanceState: extracted
  freshnessStatus: unverified
  aliases:
    - credential-file-delta-sharing
    - CF(S
  citations:
    - file: create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md
title: Credential File (Delta Sharing)
description: A file containing the bearer token that a recipient downloads once via an activation link, treated as a secret and used to authenticate and get read access to shared tables.
tags:
  - delta-sharing
  - security
  - authentication
timestamp: "2026-06-18T14:48:42.098Z"
---

# Credential File (Delta Sharing)

A **credential file** in [Delta Sharing](/concepts/delta-sharing.md) is a downloadable file generated by a data provider when creating an [OpenSharing](/concepts/opensharing.md) recipient object using the bearer token authentication method. The credential file contains the bearer token and is the mechanism by which a non-Databricks recipient authenticates to read shared data. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Overview

In the Databricks-to-Open sharing flow, the data provider creates a recipient object and selects the bearer token method. Databricks then generates a bearer token, a credential file that includes that token, and an activation link. The provider shares the activation link with the recipient over a secure channel. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

The recipient accesses the activation link, downloads the credential file, and uses it to authenticate and obtain read access to the tables that the provider has included in the shares granted to that recipient. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Security Considerations

Recipients must treat the downloaded credential file as a secret and must not share it outside of their organization. If a credential may have been handled insecurely, the provider can rotate the recipient's token at any time. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

The credential file can be downloaded only once from the activation link. After a recipient downloads the credential file, the activation link is no longer returned or displayed. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Token Rotation

When a provider rotates a recipient's token, the existing token is set to expire and a new token and activation URL are generated. If the recipient has not yet accessed the original activation URL, rotating the token invalidates that URL and replaces it with a new one. The new activation link must be shared with the recipient over a secure channel, and the recipient must apply the new credential. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Token Lifetime

Tokens issued through the bearer token method are valid for a maximum of one year after creation. The provider can optionally set an expiration time when creating the recipient; if not set, the default recipient token lifetime configured at the [Metastore](/concepts/metastore.md) level applies. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Related Concepts

- [Recipient Object (Delta Sharing)](/concepts/recipient-object-delta-sharing.md) — The object that represents the data consumer.
- [Activation Link (Delta Sharing)](/concepts/activation-link-delta-sharing.md) — The URL used to download the credential file.
- [Bearer token (Delta Sharing)](/concepts/bearer-token-authentication-for-open-sharing.md) — The authentication credential embedded in the file.
- [OpenSharing](/concepts/opensharing.md) — The sharing model that uses bearer tokens or OIDC federation.
- [Token rotation](/concepts/recipient-token-rotation.md) — The process of replacing an expiring or compromised token.
- [Databricks-to-Open Sharing](/concepts/databricks-to-open-sharing.md) — Sharing data with recipients who do not have a Databricks workspace.

## Sources

- create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md

# Citations

1. [create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md](/references/create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws-6b15f526.md)
