Authentication
Databricks authentication continues to work as normal. The proxy forwards authentication traffic to your Databricks workspace without modifying it, so credentials are never inspected, stored, or altered. Databricks performs all authentication exactly as it does today, and every authentication method it supports is unaffected by routing through the proxy.
Supported authentication methods
Personal access tokens (PATs): Tokens pass through unchanged in the
Authorizationheader and are validated by Databricks as usual.OAuth for service principals (OAuth M2M): The client ID and secret are exchanged for a short-lived access token directly with Databricks. The proxy does not see the secret or modify the token; it only forwards the resulting bearer token.
OAuth for users (OAuth U2M): The browser sign-in and consent flow happens between you and Databricks (and your identity provider, if SSO is configured). The proxy passes the OAuth discovery and token requests through untouched.
OAuth token federation: Tokens issued by your own identity provider are forwarded as-is for Databricks to verify.
Microsoft Entra ID tokens (Azure Databricks): Entra ID access tokens and managed identity credentials are forwarded unchanged.
Google Cloud credentials (Databricks on GCP): Google ID tokens are forwarded unchanged.
For details on each method, see Authorize access to Databricks resources in the Databricks documentation.
Where to point OAuth credential providers
Some tools take the workspace hostname twice: once for the SQL connection, and once for an OAuth credential provider (for example the Databricks SDK Config(host=...) used with the Python connector). Only the SQL connection needs the Espresso AI hostname. The credential provider can point at either the Espresso AI hostname or your original Databricks workspace URL; tokens issued for the workspace are valid through the proxy.
IP access lists
If you use Databricks IP access lists, please let us know. Databricks will see requests originating from the proxy's IP addresses, but we can mirror your allowlist on the proxy so requests are approved and rejected exactly per your existing policy.
Please add the following IPs to your allowlist for all users:
Last updated