Skip to main content
Version: Next

Databricks Model Provider

To use a language model deployed to Databricks Mosaic AI Model Serving, specify the model endpoint name prefixed with databricks: in the from field and include the required parameters in the params section.

Parameters​

ParameterDescription
databricks_endpointThe Databricks workspace endpoint, e.g., dbc-a12cd3e4-56f7.cloud.databricks.com.
databricks_tokenThe Databricks API token to authenticate with the Databricks Models API. Use the secret replacement syntax to reference a secret, e.g., ${secrets:my_databricks_token}.
databricks_client_idThe Databricks Service Principal Client ID. Can't be used with databricks_token. Required for workload identity federation.
databricks_client_secretThe Databricks Service Principal Client Secret. Can't be used with databricks_token.
databricks_oidc_token_filepathA file that holds the workload's identity token, read again for every exchange, such as a Kubernetes projected service account token. With databricks_client_id, the model authenticates with workload identity federation. Can't be used with databricks_token_audience.
databricks_token_audienceThe audience of the identity token Spice requests from a GitHub Actions job, such as the Databricks account ID. With databricks_client_id, the model authenticates with workload identity federation. Can't be used with databricks_oidc_token_filepath.

Example spicepod.yaml configuration, using personal access token​

To learn more about how to set up personal access tokens, see Databricks PAT docs.

models:
  - from: databricks:databricks-llama-4-maverick
    name: llama-4-maverick
    params:
      databricks_endpoint: dbc-46470731-42e5.cloud.databricks.com
      databricks_token: ${ secrets:SPICE_DATABRICKS_TOKEN }

Example spicepod.yaml configuration, using Databricks service principal​

Spice supports the Machine-to-Machine (M2M) OAuth flow with service principal credentials by utilizing the databricks_client_id and databricks_client_secret parameters. The runtime will automatically refresh the token.

The service principal must be granted the "Can Query" permission for model serving.

To learn more about how to set up the service principal, see Databricks M2M OAuth docs.

models:
  - from: databricks:databricks-llama-4-maverick
    name: llama-4-maverick
    params:
      databricks_endpoint: dbc-46470731-42e5.cloud.databricks.com
      databricks_client_id: ${secrets:DATABRICKS_CLIENT_ID}
      databricks_client_secret: ${secrets:DATABRICKS_CLIENT_SECRET}

Example spicepod.yaml configuration, using workload identity federation​

The model can authenticate as a service principal with the identity token its platform gives it, so no Databricks token or client secret is stored. Set databricks_client_id to the service principal's application ID, and set either databricks_oidc_token_filepath or, in a GitHub Actions job, databricks_token_audience.

The service principal must be granted the "Can Query" permission for model serving. See workload identity federation for the federation policy the service principal needs and how Spice renews the token.

models:
  - from: databricks:databricks-llama-4-maverick
    name: llama-4-maverick
    params:
      databricks_endpoint: dbc-a12cd3e4-56f7.cloud.databricks.com
      databricks_client_id: ${secrets:DATABRICKS_CLIENT_ID}
      databricks_oidc_token_filepath: /var/run/secrets/tokens/databricks

Additional Information​

Refer to the Mosaic AI Model Serving documentation for more details on available models and configurations.