---
type: concept
x-llmwiki:
  schemaVersion: "0.1"
  contentHash: 2f19002dc8077e9bc03e0f0c6d8de7a02c2ad8ab4660cd99e4a7be97cbdf5537
  pageDirectory: concepts
  sources:
    - create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md
  confidence: 0.9
  provenanceState: extracted
  freshnessStatus: unverified
  aliases:
    - activation-link-delta-sharing
    - AL(S
    - Activation Link
    - Activation link
    - activation-link-for-delta-sharing-recipients
    - ALFDSR
  citations:
    - file: create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md
title: Activation Link (Delta Sharing)
description: A secure URL generated when creating an Open Sharing recipient, used by non-Databricks recipients to download their credential file once for authentication.
tags:
  - delta-sharing
  - recipient-management
  - security
timestamp: "2026-06-19T09:29:15.437Z"
---

# Activation Link (Delta Sharing)

**Activation Link (Delta Sharing)** is a one-time-use URL generated by Databricks when creating a recipient object for Databricks-to-Open sharing using bearer token authentication. The activation link allows non-Databricks recipients to securely download a credential file that grants them read access to shared data. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Overview

In the [Delta Sharing](/concepts/delta-sharing.md) Databricks-to-Open sharing flow, when a data provider creates a recipient object with the bearer token method, Databricks generates a token, a credential file that includes the token, and an activation link. The provider shares this activation link with the recipient over a secure channel. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

The recipient accesses the activation link, downloads the credential file, and uses the credential file to authenticate and get read access to the tables included in the shares they have been granted access to. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Getting the Activation Link

To retrieve a recipient's activation link, the provider can use Catalog Explorer, the Databricks Unity Catalog CLI, or the `DESCRIBE RECIPIENT` SQL command. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

**Permissions required**: [Metastore](/concepts/metastore.md) admin, user with the `USE RECIPIENT` privilege, or the recipient object owner. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

If the recipient has already downloaded the credential file, the activation link is not returned or displayed. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Security Considerations

The credential file can be downloaded only once. Recipients should treat the downloaded credential as a secret and must not share it outside of their organization. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

If a recipient's existing activation URL has never been accessed, rotating the existing token invalidates that activation URL and replaces it with a new one. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

If a recipient activation URL is inadvertently sent to the wrong person or is sent over an insecure channel, Databricks recommends the following steps: ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

1. Revoke the recipient's access to the share.
2. Rotate the recipient and set `--existing-token-expire-in-seconds` to `0`.
3. Share the new activation URL with the intended recipient over a secure channel.
4. After the activation URL has been accessed, grant the recipient access to the share again.

## Token Rotation and Activation Links

When a provider rotates a recipient's token, a new activation URL is generated. The provider must share this new activation link with the recipient over a secure channel. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

After sharing the new activation link, the recipient must apply the new credential on their side. If the recipient imported the credential as a provider object in Unity Catalog, they must update the provider object with the Databricks REST API. ^[create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md]

## Related Concepts

- [Delta Sharing](/concepts/delta-sharing.md) — The open protocol for secure data sharing
- [Recipient Object (Delta Sharing)](/concepts/recipient-object-delta-sharing.md) — The object that defines a data consumer
- [Bearer Token Authentication (Delta Sharing)](/concepts/bearer-token-authentication-for-open-sharing.md) — The authentication method that uses tokens
- [Open Sharing (Delta Sharing)](/concepts/opensharing-delta-sharing.md) — Sharing with non-Databricks recipients
- [Credential File (Delta Sharing)](/concepts/credential-file-delta-sharing.md) — The file downloaded via the activation link
- [Token Rotation (Delta Sharing)](/concepts/recipient-token-rotation.md) — The process of replacing an existing token

## Sources

- create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md

# Citations

1. [create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws.md](/references/create-a-recipient-object-for-non-databricks-users-using-bearer-tokens-databricks-to-open-sharing-databricks-on-aws-6b15f526.md)
