---
title: "Now GA: Building permission-aware Databricks Apps with on-behalf-of-user authorization"
description: "Databricks Apps now generally supports on-behalf-of-user (OBO) authorization, enabling apps to act using the signed-in user’s identity so Unity Catalog enforces existing data permissions including row filters and column masks. Developers choose between app authorization for app-owned operations and user authorization for user-specific data access, with API scopes such as sql:restricted-query limiting what the app can do on the user’s behalf. The forwarded user access token is short-lived and per-request, passed via the x-forwarded-access-token HTTP header to the SQL connector, and the app must never store it. Workspace administrators can set an allowlist of API scopes, providing two levels of control: the app declares minimum scopes and the workspace defines the maximum, with account administrators able to add scopes outside the allowlist. The post recommends keeping app-owned and user-authorized clients separate in code and failing closed when a user token is missing to avoid returning results with incorrect permissions."
---

# Now GA: Building permission-aware Databricks Apps with on-behalf-of-user authorization

[Databricks](https://yomu.fyi/company/databricks) · Aakrati Talati, Cynthya Peranandam, Tushar Madan, Evan Pandya, Theo Fernandez · Oct 7, 2026

**Type:** Announcement

## Summary

Databricks Apps now generally supports on-behalf-of-user (OBO) authorization, enabling apps to act using the signed-in user’s identity so Unity Catalog enforces existing data permissions including row filters and column masks. Developers choose between app authorization for app-owned operations and user authorization for user-specific data access, with API scopes such as sql:restricted-query limiting what the app can do on the user’s behalf. The forwarded user access token is short-lived and per-request, passed via the x-forwarded-access-token HTTP header to the SQL connector, and the app must never store it. Workspace administrators can set an allowlist of API scopes, providing two levels of control: the app declares minimum scopes and the workspace defines the maximum, with account administrators able to add scopes outside the allowlist. The post recommends keeping app-owned and user-authorized clients separate in code and failing closed when a user token is missing to avoid returning results with incorrect permissions.

## Context

Databricks Apps is a platform for building data and AI applications directly on Databricks. The new on-behalf-of-user authorization allows apps to use the signed-in user’s identity to enforce Unity Catalog permissions, with API scopes limiting operations.

## Approach / What changed

Use on-behalf-of-user authorization by configuring the app with an explicit API scope (e.g., sql:restricted-query), retrieving the forwarded user access token from the x-forwarded-access-token header per request, and passing it to the Databricks SQL connector. Keep app-owned and user-authorized clients separate in code and tests, and fail closed if the user token is missing.

## Takeaways

- OBO authorization lets apps enforce Unity Catalog permissions (row filters, column masks) without reimplementing governance in application code.
- API scopes like sql:restricted-query limit what the app can do on the user’s behalf; workspace administrators can set an allowlist to control maximum scopes.
- The forwarded user token is short-lived and per-request; apps must never store it and should fail closed if the token is missing.

## FAQ

### How does OBO differ from app authorization?

App authorization uses the app's dedicated service principal for app-owned operations like reading shared configuration. User authorization uses the signed-in user's identity via OBO, so Unity Catalog enforces that user's data permissions. Most production apps use both models for different request paths.

### What API scope for a read-only app?

A read-only analytics app should request sql:restricted-query, which allows executing read-only SQL queries but not broader SQL operations like managing resources. This matches the app's product behavior to its authorization boundary.

### How to control API scopes in workspace?

Workspace administrators set an allowlist under Settings > Development > Apps, defining the maximum API scopes available to apps. The default is all supported APIs; it can be narrowed to selected scopes or set to None to disable user authorization.

**Tags:** [Authorization](https://yomu.fyi/topic/authorization), [Databricks](https://yomu.fyi/topic/databricks), [Unity Catalog](https://yomu.fyi/topic/unity-catalog)

- Source: [Databricks](https://www.databricks.com/blog/now-ga-building-permission-aware-databricks-apps-behalf-user-authorization)
- Source URL: https://www.databricks.com/blog/now-ga-building-permission-aware-databricks-apps-behalf-user-authorization
- Ingested by Yomu: 2026-10-07T18:00:13.076Z

[Read original post](https://www.databricks.com/blog/now-ga-building-permission-aware-databricks-apps-behalf-user-authorization)