Token

Bearer token presented on every request. Skips the username + password auth round-trip.

Category: connection-string

Syntax

Token=<bearer-token>

Description

## When to use Use `Token=` when you have a Delta Forge personal access token and want to avoid storing a password. PATs are scoped to the issuing user and can be revoked from the desktop app without affecting the user's password. The token is also the right path for unattended jobs: store the PAT in a secret manager (Vault, AWS Secrets Manager, the OS keychain) and inject it into the BI tool's environment so the connection string never has a credential in plaintext. ## Aliases The parser accepts `AccessToken=` and `OAuthToken=` as aliases so connection strings copied from Snowflake or Databricks tooling do not need to be rewritten. All three keys map to the same internal slot; if more than one is supplied, the parser uses whichever was set first. ## Token shape The driver does not parse the token. It is forwarded as the `Authorization: Bearer <token>` header on every HTTP request. The Delta Forge engine validates `df_pat_`-prefixed tokens against the personal-access-tokens table; session tokens (`df_` prefix) are validated against the live session table. ## Refresh The driver does not refresh the token mid-session. If the token is revoked or expires, the next request fails with an authentication SQLSTATE; the application is expected to disconnect and reconnect with a fresh token.

Parameters

Name	Type	Description
`Token`		Delta Forge personal access token (prefix `df_pat_`, generated from the desktop app's Settings -> Personal Access Tokens page) or a session token (prefix `df_`). When supplied, the driver attaches the value as a bearer credential on every request and skips the password auth round-trip.

Examples

# Personal access token
Token=df_pat_abcd1234efgh5678ijkl

# Aliases (Snowflake / Databricks vocabulary)
AccessToken=df_pat_abcd1234efgh5678ijkl
OAuthToken=df_pat_abcd1234efgh5678ijkl

Pitfalls

A leading or trailing whitespace in `Token=` is preserved by the parser; trim before assigning.
Pasting a token that lacks the `df_pat_` or `df_` prefix is silently accepted and forwarded; the engine returns the auth error. Confirm the prefix is intact.
Storing a long-lived PAT in a connection-string file on disk has the same exposure profile as a cleartext password. Prefer the OS keychain so the token can be rotated without editing files.