---
type: concept
x-llmwiki:
  schemaVersion: "0.1"
  contentHash: 2f807223ed5294cfd7c733198c60d8933cd773de3d4c3328bd07aa3dfc626ee0
  pageDirectory: concepts
  sources:
    - create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md
  confidence: 0.9
  provenanceState: extracted
  freshnessStatus: unverified
  aliases:
    - opensharing-recipient-activation-link
    - ORAL
    - Delta Sharing Activation Link
    - OpenSharing Activation URL
  citations:
    - file: create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md
title: OpenSharing Recipient Activation Link
description: A URL generated by Databricks when creating a recipient object that allows the recipient to download a credential file once for authenticating and accessing shared Delta Sharing data.
tags:
  - delta-sharing
  - authentication
  - databricks
timestamp: "2026-06-19T14:31:06.115Z"
---

# OpenSharing Recipient Activation Link

**OpenSharing Recipient Activation Link** is a URL generated by [Unity Catalog](/concepts/unity-catalog.md) when a data provider creates an OpenSharing recipient object using the bearer token authentication method. The activation link allows recipients who do not have access to a [Unity Catalog](/concepts/unity-catalog.md)-enabled Databricks workspace to securely download a credential file and authenticate for read access to shared data. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Overview

The activation link is part of the Databricks-to-Open sharing bearer token flow. When a provider creates a recipient with the token authentication type, Databricks generates a token, a credential file that includes the token, and an activation link. The provider shares this link with the recipient over a secure channel. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

The recipient accesses the activation link, downloads the credential file (which can only be downloaded once), and uses that credential to authenticate and gain read access to the tables included in the shares they have been granted. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Retrieving the Activation Link

After creating a recipient, the provider can retrieve the activation link using Catalog Explorer, the Databricks Unity Catalog CLI, or the `DESCRIBE RECIPIENT` SQL command. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

**Permissions required**: [Metastore](/concepts/metastore.md) admin, user with the `USE RECIPIENT` privilege, or the recipient object owner. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

If the recipient has already downloaded the credential file, the activation link is not returned or displayed. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Token Rotation and Activation Links

When a recipient's token is rotated, the existing activation link is invalidated and replaced with a new one. This occurs if the existing activation URL has never been accessed. If all recipient tokens have expired, rotating the token also replaces the existing activation URL with a new one. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

Databricks recommends that providers promptly rotate or drop a recipient whose token has expired. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Security Best Practices

If an activation URL is inadvertently sent to the wrong person or over an insecure channel, Databricks recommends the following steps: ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

1. Revoke the recipient's access to the share.
2. Rotate the recipient and set `--existing-token-expire-in-seconds` to `0`.
3. Share the new activation URL with the intended recipient over a secure channel.
4. After the activation URL has been accessed, grant the recipient access to the share again.

Credential files should be treated as secrets and must not be shared outside of the recipient's organization. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Related Concepts

- [OpenSharing Recipient Object](/concepts/opensharing-recipient-object.md) — The recipient configuration that generates the activation link
- [Bearer Token Authentication](/concepts/bearer-token-authentication-for-open-sharing.md) — The authentication method used with activation links
- [OIDC Token Federation for OpenSharing](/concepts/oidc-token-federation-for-opensharing.md) — Alternative authentication flow with security advantages
- [Recipient Token Rotation](/concepts/recipient-token-rotation.md) — Process for replacing expired or compromised tokens
- Managing OpenSharing Recipients — Full lifecycle management of recipient objects

## Sources

- create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md

# Citations

1. [create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md](/references/create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws-6b15f526.md)
