The agent is instructed to use this integration for reads only. That instruction is not enforcement: the SQL clients send the statement they are given, as you, so a connecting user who can write can write. Grant
SELECT and nothing more if you want writes to be impossible rather than merely unasked for.Prerequisites
Before connecting, your workspace needs:- Unity Catalog enabled, with at least one catalog you want Qualia to read.
- A SQL warehouse. Serverless is recommended — it starts in seconds, where a classic warehouse can take several minutes on the first query.
- A Genie Space covering the tables Qualia should answer questions about. Selected during setup and checked by the access preflight.
- Partner-powered AI features enabled in workspace admin settings. Genie does not answer without it.
- An OAuth application registered in your Databricks account console. Databricks does not support automatic app registration, so this step cannot be skipped.
Required privileges
Registering the OAuth application needs someone with access to the Databricks account console. On Qualia Cloud, saving the workspace configuration also needs an organization admin in Qualia; on desktop there is one install and one user, so you configure it yourself. Each person who then signs in needs the following in Databricks:
These are deliberately non-admin privileges. Nobody needs workspace-admin rights to use the integration.
Registering the OAuth application
In the Databricks account console, create an OAuth application:- Note the client ID. Create a client secret as well if you want a confidential client; a public client works without one.
- Add the redirect URL shown in Qualia’s Databricks settings. It must match exactly, including the path and, on desktop, the port. Databricks does not accept the arbitrary loopback port that RFC 8252 allows, which is why the desktop URL names a fixed one —
http://127.0.0.1:8020/api/databricks/callbackby default. SetDATABRICKS_CALLBACK_PORTif something else on your machine already holds that port, then register the URL Qualia shows afterward. - Grant the scopes
sql,genie,unity-catalog,offline_access,openid,email, andprofile.unity-catalogis what lets the access preflight list your catalogs;offline_accesslets Qualia refresh access without sending you back through the browser every hour; andopenid email profileidentify who authorized, so Qualia can bind the authorization to your Qualia account.
Connecting
Setup is two steps, and the settings page labels them as such. Step 1, Workspace points Qualia at a Databricks workspace and its OAuth application. Step 2, Your access is your personal sign-in, and stays disabled until step 1 is saved.- Go to Settings → Integrations → Databricks.
- Enter your workspace URL (for example
dbc-a1b2c3d4-e5f6.cloud.databricks.com) and pick the cloud it runs on. - Paste the OAuth client ID, and the client secret if you created one.
- Confirm the redirect URL matches what you registered.
- Click Save and continue. Qualia verifies the workspace responds before storing anything.
- Under Your access, click Sign in with Databricks and authorize.
catalog.schema.table names, so the default is a convenience rather than something queries depend on.
On Qualia Cloud, every other member of your organization then signs in individually from the same settings page: the workspace configuration is shared, the authorization is not. The warehouse, Genie Space, catalog, and schema are part of that shared configuration, so only an organization admin can change them — everyone else signs in and uses what the admin picked. On desktop the configuration and the authorization are both yours alone.
Authentication methods
Personal access tokens are not supported for any path Qualia actually queries with. They do not expire on their own and cannot be attributed to a person, which makes them a poor fit for governed data access. One narrow exception exists for compatibility: some versions of the Databricks Partner Connect contract still send a token when provisioning, and Qualia stores what it is sent. Nothing reads it — every credential Qualia queries with is an OAuth token — so a workspace provisioned that way has no working path until an admin registers an OAuth application or configures a service principal, and re-provisioning with OAuth credentials removes the stored token.
Setting up a service principal (M2M)
Use this when work runs without a person present to authorize it. The service principal’s Unity Catalog grants apply instead of the requesting user’s, so grant it only what the automation needs.- In your Databricks account console, go to User management → Service principals and create one.
- On the service principal, generate an OAuth secret. Record the client ID and secret; the secret is shown once.
- Grant it the same privileges a person needs —
CAN USEon the SQL warehouse,USE CATALOGandUSE SCHEMAon the parents, andSELECTon the tables. - Provide the client ID and secret through the Databricks Partner Connect tile. Nothing in Qualia’s settings page accepts an M2M secret, so a workspace you connected by hand should use token federation below instead — it needs no secret at all.
Setting up token federation
Token federation reaches the same service principal without a secret stored anywhere. Qualia signs a short-lived assertion, a policy you control decides whether to trust it, and Databricks returns a token. You have no secret to rotate or leak; Qualia rotates its own signing keys, and the policy discovers them. Where both are configured, Qualia prefers federation over M2M. Qualia Cloud only. The desktop app has no public address to publish verification keys from.- Create a service principal as above — steps 1 and 3, skipping the OAuth secret.
- In Qualia, open Settings → Integrations → Databricks. Under Authentication method, set Query as to Service principal, then enter the service principal’s application ID. Leave Federation audience blank unless your policy needs a specific one. Save. Note what this changes: every query then runs as that one service principal, so its Unity Catalog grants apply to everyone in your organization and no answer is attributable to an individual. Leave Query as on Each person if you want per-user governance.
- A Federation policy section appears with the exact values Qualia will sign. They are specific to your organization, and each one has a copy button.
- In your Databricks account console, open the service principal and add a federation policy:
Leave token signature validation empty. Databricks then fetches the key from
https://api.quadrillion.io/.well-known/openid-configuration, which is what lets Qualia rotate signing keys without you touching the policy.
The subject names your organization, so a policy pinned to it cannot be satisfied by an assertion minted for any other Qualia tenant.
Nobody signs in individually under Service principal, so step 2 offers no Sign in with Databricks button. The warehouse and Genie Space pickers appear as soon as the connection is saved, and what they list is what the service principal can reach.
Partner Connect
If you reach Qualia through the Databricks Partner Connect tile, Databricks provisions the workspace details for you and sends you to Qualia to finish. An organization admin lands on the settings page with the workspace already filled in and only needs to confirm it, then pick a warehouse and Genie Space. Re-running the tile for a workspace that is already connected updates it in place rather than creating a second connection, and re-enables one that a trial expiry had disabled. If your trial lapses, the connection is disabled rather than deleted: existing authorizations stop working immediately, and converting restores the setup instead of making you redo it.Querying from a notebook
A Databricks helper is available in every Python, R, and Julia kernel. It fetches a credential on your behalf and renews it as it ages, so nothing expires mid-session and no token is written into the kernel environment. In Python the helper needs thedatabricks-sql-connector[pyarrow] package. Qualia Cloud kernels already have it. On desktop, the first query reports that it is missing and the agent offers to install it for you — a one-time step per kernel environment, not something you repeat.
data.frame, and a column table Julia’s DataFrame accepts directly — and all three take catalog and schema to override the defaults saved on the connection. workspace_info() reports which workspace, warehouse, catalog, and schema a notebook is pointed at, without exposing the token.
Pass values as parameters rather than building them into the SQL string. The warehouse then parses them as data and never as SQL:
query opens its own connection. For several statements, use connect instead, which returns a DB-API connection you can reuse:
catalog.schema.table name. A bare table name resolves against whatever default the connection carries, which is the most common cause of an unexpected “table not found”.
The R and Julia clients read results over the Databricks SQL Statement Execution API, which caps a single result at 25 MiB. Aggregate or
LIMIT in SQL rather than pulling a whole table into the kernel. Python has no such cap.Asking Genie
With a Genie Space selected, the agent can put a question to it in plain language and show you the answer with a link back to the Space. Genie knows the joins and business definitions your admin curated there, so it is often a better first stop than SQL written against tables nobody has inspected yet. Genie returns an answer to read, not data in your notebook. Ask Genie to orient, then query through the client above when you need values you can compute on — a Genie answer cannot be captured as evidence for a finding.Reconnecting
Access tokens expire roughly hourly and Qualia refreshes them silently. If a refresh fails permanently — your Databricks session ended, an admin revoked the app, or the OAuth application changed — the settings page shows reconnect required. Click Re-authorize to fix it. Nothing else is affected in the meantime.Rotating the client secret
Enter the new value in the OAuth client secret field and save. Leaving it blank keeps the stored secret, so an unrelated edit never overwrites it. Existing user authorizations survive a rotation.Disconnecting
Disconnect removes your own authorization and discards your stored tokens immediately. Any open Genie session is closed at the same time. On Qualia Cloud, other members are unaffected. Remove deletes the whole workspace configuration along with every authorization it covers. On Qualia Cloud only an organization admin can do this.Where credentials are stored
Qualia stores your workspace configuration, the OAuth client ID and secret, and access and refresh tokens. Tokens and secrets never appear in logs, tool results, notebook environments, or API responses. A federated connection stores no credential at all beyond the service principal’s client ID, which is an identifier rather than a secret. The assertion is signed on demand and the token Databricks returns is held in memory until it expires. On Qualia Cloud they are encrypted at rest in the database, one authorization per member. On desktop the configuration goes to yoursettings.json and the tokens to your operating system keychain — Keychain on macOS, Credential Manager on Windows, Secret Service or KWallet on Linux. If your machine has no keychain, Qualia falls back to a 0600 file under ~/.quadrillion/databricks/, which is weaker: anything running as your user can read it.
If the keychain is locked when Qualia needs a token, the settings page reports that rather than showing you as disconnected. Unlock it and retry.
Qualia does not copy your lakehouse data. Query results live in the notebook you ran them in, and Genie answers live in the conversation. Disconnecting discards the stored tokens; removing the connection discards the configuration too.
Troubleshooting
Attribution
Qualia identifies itself to Databricks on every request so your workspace admins can attribute usage insystem.access.audit.
The Databricks Partner Well Architected Framework requires attribution wherever Genie-generated content appears, and in any product reference to the integration. Qualia shows a Powered by Genie label on every surface that references the integration.
Each Genie answer displayed in chat also:
- Renders Genie’s content blocks unmodified rather than summarized by the model.
- Keeps every URI Genie returns a working link.
- Cites the Genie Space that produced it.

