---
type: concept
x-llmwiki:
  schemaVersion: "0.1"
  contentHash: db574757bcb6c7605d9963ed92f54f98646929836376f077a537dd546eee11bb
  pageDirectory: concepts
  sources:
    - read-data-shared-using-open-id-connect-oidc-federation-from-an-iceberg-client-databricks-on-aws.md
    - what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md
  confidence: 0.9
  provenanceState: merged
  freshnessStatus: unverified
  aliases:
    - bearer-token-authentication-for-opensharing
    - BTAFO
  citations:
    - file: what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md
    - file: read-data-shared-using-open-id-connect-oidc-federation-from-an-iceberg-client-databricks-on-aws.md
title: Bearer Token Authentication for OpenSharing
description: Alternative authentication method for non-Databricks users accessing Databricks-to-Open sharing, contrasted with OIDC federation in this guide.
tags:
  - authentication
  - bearer-token
  - data-sharing
timestamp: "2026-06-19T20:08:53.492Z"
---

# Bearer Token Authentication for OpenSharing

**Bearer Token Authentication for OpenSharing** is one of two authentication methods supported by the Databricks-to-Open sharing protocol, alongside [Open ID Connect (OIDC) Federation for OpenSharing](/concepts/oidc-federation-for-opensharing.md). It uses a long-lived bearer token generated by Databricks to authenticate non-Databricks recipients when accessing shared data through OpenSharing. ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]

## Overview

In the bearer token authentication flow, the data provider creates a recipient object that represents a user or group of users they want to share data with. When the provider creates the recipient using bearer token authentication, Databricks generates a credential file and an activation link. The data provider then sends the activation link to the recipient over a secure channel, along with instructions for downloading the credential file. ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]

The recipient uses the credential file to establish a secure connection with the data provider and access the shared data. Shared data is available to read only, and recipients can access it using their platform or tools of choice. ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]

## Comparison with OIDC Federation

Bearer token authentication is an alternative to OIDC federation. In the OIDC federation flow, the recipient's identity provider (IdP) manages authentication based on a policy created by the provider. For recipients using OIDC federation, an Iceberg REST Catalog (IRC) client is used to access OpenSharing shares. ^[read-data-shared-using-open-id-connect-oidc-federation-from-an-iceberg-client-databricks-on-aws.md]

If you are using bearer tokens to manage authentication, you should refer to the documentation on creating a recipient object for non-Databricks users using bearer tokens, rather than the OIDC-based approach. ^[read-data-shared-using-open-id-connect-oidc-federation-from-an-iceberg-client-databricks-on-aws.md]

## Provider Setup and Security

Good token management is essential for secure data sharing when using bearer token authentication: ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]

- Data providers must configure the default recipient token lifetime when they enable OpenSharing for their [Unity Catalog](/concepts/unity-catalog.md) [Metastore](/concepts/metastore.md). Databricks recommends configuring tokens to expire. ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]
- The default token lifetime can be modified if needed, using the recipient token management features. ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]
- Data providers should encourage recipients to manage their downloaded credential file securely. ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]
- Token rotation and management are important aspects of OpenSharing security. ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]

## Additional Security Measures

Data providers can enhance security by assigning IP access lists to restrict recipient access to specific network locations. This provides an additional layer of protection beyond token-based authentication for the Databricks-to-Open sharing model. ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]

## Workflow Steps

The bearer token authentication workflow follows these steps:

1. The data provider creates a recipient object and sets up authentication using a long-lived bearer token. Databricks generates a credential file and an activation link. ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]
2. The data provider creates a share containing a collection of tables registered in a Unity Catalog [Metastore](/concepts/metastore.md). ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]
3. The data provider grants the recipient access to the share. ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]
4. The data provider sends the activation link to the recipient over a secure channel. ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]
5. The recipient follows the activation link to download the credential file and uses it to access the shared data. ^[what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md]

## Related Concepts

- [OpenSharing Databricks-to-Open Sharing Protocol](/concepts/opensharing-databricks-to-open-protocol.md)
- [Open ID Connect (OIDC) Federation for OpenSharing](/concepts/oidc-federation-for-opensharing.md)
- [Delta Sharing](/concepts/delta-sharing.md)
- [Unity Catalog](/concepts/unity-catalog.md)
- OpenSharing Recipient Management
- [Recipient Token Lifetime Configuration](/concepts/recipient-token-lifetime.md)
- [IP Access Lists for OpenSharing](/concepts/ip-access-lists-for-opensharing-recipients.md)
- [Cloud Tokens and Directory-Based Access](/concepts/cloud-token-access-directory-based-access.md)

## Sources

- what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md
- read-data-shared-using-open-id-connect-oidc-federation-from-an-iceberg-client-databricks-on-aws.md

# Citations

1. [what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws.md](/references/what-is-the-opensharing-databricks-to-open-sharing-protocol-databricks-on-aws-e4f6895b.md)
2. [read-data-shared-using-open-id-connect-oidc-federation-from-an-iceberg-client-databricks-on-aws.md](/references/read-data-shared-using-open-id-connect-oidc-federation-from-an-iceberg-client-databricks-on-aws-2663b307.md)
