Leaked Databricks API Token: what to do in the first hour

• Profile files. A .databrickscfg file with token = … committed with a project or a dotfiles repository.
• Notebooks. A token pasted into a notebook cell, then exported or synced to a Git repository with its outputs.
• Pipeline configuration. DATABRICKS_TOKEN written in plain text in a CI workflow or a bundle configuration.
• Connector settings. A BI tool or an application connection string that carries the token as the password.
• Support requests. A token pasted while asking why a job fails with a permission error.

1. Find the token. In the workspace, open your user settings and the developer section where access tokens are listed. The list shows the comment, the creation date and the expiry date. Workspace administrators can also list the tokens of all users from the admin settings.
2. Create a replacement. For automation, prefer a service principal with a narrow set of permissions over a token tied to a person.
3. Deploy the new credential where the old one was used and run one job to confirm.
4. Revoke the exposed token from the same list. Requests using it are then refused.
5. Review the audit trail. Look for jobs, notebooks or clusters you did not start, new libraries installed on clusters, new users or tokens, and queries on tables the integration normally never reads.
6. Check what the user could read. List the catalogs, schemas, tables and secret scopes the user had access to. If sensitive data could have been read, follow your incident procedure for data exposure.
7. Rotate secrets reachable from the workspace. Cloud keys, database passwords and secrets stored in notebooks or secret scopes should be treated as exposed. See I accidentally pushed an API key to GitHub.

Not sure what else leaked from the same repository? Run a free scan.

Databricks personal access tokens are revoked inside the workspace that issued them. Sign in to that workspace, open your user settings, go to the developer section and the access tokens list, and revoke the exposed one. An administrator can do it for any user from the workspace admin settings. There is no single global page: the address depends on the workspace host, so a leaked token must be revoked in the workspace named in the nearby configuration. Databricks documents token management and token lifetimes. Menu names can change, so look for the section that lists access tokens.

The rule is called Databricks API Token. It matches dapi followed by exactly 32 lowercase hex characters and an optional dash and digit, bounded as a whole word. Uppercase or shorter strings are ignored on purpose, to avoid unrelated identifiers that begin with the same letters. The severity is critical, because a token can reach data and compute. This type is not checked live: LeakWatch does not call your workspace with the value, so a finding means the string was seen, not that the token is active. Open the token list to check whether it still exists.