The new databricks_lakebase_token data source generates a one-hour OAuth token for a Databricks Lakebase Postgres endpoint from inside the project file, so the connection URL carries no static password.

The new databricks_lakebase_token data source generates an OAuth token for a Databricks Lakebase Postgres endpoint. The token expires one hour after it is issued, and Atlas generates a new one on each run. The connection URL carries no static password.

The data source is part of Atlas Pro. Run atlas login to create an account or start a free trial.

Declaring the Data Source

Set endpoint to the endpoint path, and use the token as the password in the URL. The user is the identity the token is issued to: the email of a Databricks user, or the application ID of a service principal. Set both with urluserinfo, which escapes the @ in the email:

atlas.hcl

data "databricks_lakebase_token" "db" {
  endpoint = "projects/my-app/branches/production/endpoints/primary"
}

env "lakebase" {
  # The Databricks email contains "@", so it must be URL-escaped
  # with urluserinfo (or urlescape) rather than interpolated.
  url = urluserinfo(
    "postgres://ep-example.database.us-west-2.cloud.databricks.com:5432/databricks_postgres?sslmode=require&search_path=public",
    "user@example.com",
    data.databricks_lakebase_token.db,
  )
}

Credentials

The data source signs in to Databricks with unified authentication. It accepts:

A service principal: DATABRICKS_HOST, DATABRICKS_CLIENT_ID, and DATABRICKS_CLIENT_SECRET in the environment.
A .databrickscfg profile, selected with the optional profile attribute or DATABRICKS_CONFIG_PROFILE.
A databricks auth login profile, which needs the databricks binary on the PATH.

The optional host attribute sets the workspace URL, and defaults to DATABRICKS_HOST or the host of the profile.

The Databricks Lakebase guide covers finding the endpoint, password roles, both migration workflows, and the errors you may see.

Databricks: Lakebase Token Data Source

Declaring the Data Source

Credentials