Use this guide if you are a ChatGPT workspace admin or a ChatGPT Plus or Pro user setting up the Databricks Genie connector with your organization's Databricks OAuth client.
For Databricks, most of the setup happens in the Databricks Account Console. You create a custom OAuth app connection, register the ChatGPT callback URL, copy the generated client credentials, then enter those values in the ChatGPT connector setup flow.
What you are setting up
You are creating a Databricks app connection for your ChatGPT account or workspace. The connection uses:
A Databricks OAuth app connection created in your Databricks Account Console.
The Databricks OAuth client ID and client secret.
The exact callback URL copied from ChatGPT.
Databricks scopes that match the connector capabilities you want to enable.
Any Databricks provider details requested by the ChatGPT setup flow, such as workspace host, account host, account ID, or warehouse.
Before you start
You need:
ChatGPT workspace admin or owner access, or a ChatGPT Plus or Pro account.
Databricks account admin access. Workspace admin access may be enough for some tasks, but custom app connections are configured from the Databricks Account Console.
The Databricks Account Console open in a separate tab.
The Databricks Genie connection screen open in ChatGPT so you can copy the exact callback URL.
A decision about whether the app needs general Databricks API access or only Databricks SQL access.
A secure place to handle the Databricks client secret.
If your Databricks account or workspace restricts access through an IP access list, context-based ingress control, a firewall, or another network policy, help from a Databricks admin who can allow the current ChatGPT connector egress IP ranges.
Note: you must copy the exact Callback URL shown in ChatGPT.
Values to prepare
Callback URL: copy this from the ChatGPT connector setup flow.
Databricks OAuth client ID.
Databricks OAuth client secret.
Databricks access scopes, such as ALL APIs or SQL.
Databricks workspace or account fields requested by the ChatGPT setup flow.
Start the app setup in ChatGPT
In ChatGPT, switch to the account or workspace where the app should be available.
Go to Workspace settings > Plugins as a workspace admin or owner.
Choose Databricks Genie in Directory.
Select Add App Connection.
In the Connect Databricks Genie dialog, find the OAuth client section.
Callback URL from ChatGPT. Keep this dialog open.
Example callback URL:
https://chatgpt.com/connector/oauth/<callback_id>
Do not remove the callback ID, add a trailing slash, or replace it with a generic ChatGPT URL. The URL registered in Databricks must exactly match the Callback URL shown in ChatGPT.
Create the OAuth app connection in Databricks
Open the Databricks Account Console for your Databricks account.
In the left sidebar, open Settings.
Open the App connections tab.
Select Add connection.
Enter an application name, such as ChatGPT Databricks Connector.
In Redirect URLs, paste the exact callback URL copied from ChatGPT.
Under Access scopes, choose the scopes the app needs.
Use ALL APIs for a general Databricks app that needs Databricks APIs beyond SQL.
Use SQL only for an app limited to Databricks SQL APIs.
Make sure every scope later listed in ChatGPT is enabled on this Databricks OAuth app. Databricks automatically allows openid, email, profile, and offline_access for apps created in the UI.
Leave token TTLs at the Databricks defaults unless your organization has a specific policy: 60 minutes for the access token and 10080 minutes for the refresh token.
Turn on Generate a client secret. ChatGPT needs a confidential OAuth client for this flow.
Create the connection.
Copy credentials from Databricks
In the Connection created dialog, copy the Client ID.
Copy the Client secret immediately and store it securely.
If you close the dialog before copying the secret, create or rotate the OAuth app credentials and use the new secret.
Databricks shows the secret only once. Treat it like a credential and do not include it in screenshots, tickets, comments, or chats.
Finish setup in ChatGPT
Return to the Connect Databricks Genie dialog.
Enter the Databricks client ID in OAuth client ID.
Enter the Databricks client secret in OAuth client secret.
In Scopes (optional), keep all-apis and offline_access for general API access.
Enter one scope per line or separate scopes with commas. Every scope listed in ChatGPT must be enabled on the Databricks OAuth app.
Enter the Workspace hostname (required) without https:// or a URL path. Fill any other required Databricks provider fields shown in the setup flow.
Select Continue.
ChatGPT requests exactly the scopes entered in Scopes (optional). It does not automatically add broader template scopes.
Connect and test
Review the connector details, actions, and authentication settings.
If you are a workspace admin, enable the connector for the workspace and configure who can use it according to workspace policy.
Start the connect flow from ChatGPT as an allowed test user, then sign in to Databricks.
Confirm that the browser opens the expected Databricks account or workspace.
Review the requested scopes, then select Authorize.
Verify that the browser returns to ChatGPT and the connector shows as connected.
Run a low-risk read action first, such as fetching current user information or querying an approved Databricks SQL resource.
If write actions are enabled, test with a clearly low-risk Databricks workflow before broader rollout.
For a workspace setup, ask an allowed non-admin workspace member to connect and repeat the low-risk test.
Manage access
Databricks and ChatGPT both contribute to access control.
In ChatGPT, workspace admins manage whether the app is available and how members can use it. Review the Databricks apps admin controls (Workspace settings > Apps) for:
User access, to configure which workspace roles can use the connector.
Action control, to configure which Databricks actions are enabled.
App permissions, to configure when ChatGPT asks members before using the connector.
These app permissions apply to ChatGPT conversations. Workspace Agents use per-agent controls set by the agent's builder to determine which app actions are available and when end users are asked to approve them. For agent behavior, see: ChatGPT Workspace Agents for Enterprise and Business.
In Databricks, admins manage which users can authorize the OAuth app and which Databricks resources those users can access. Provider permissions still apply after the app is enabled in ChatGPT.
Troubleshooting Databricks connector setup
Redirect URI mismatch: Confirm that the Databricks Redirect URLs value exactly matches the Callback URL shown in ChatGPT, including its path and callback ID. Do not remove the callback ID, add a trailing slash, or substitute another ChatGPT redirect URL.
Secret missing: Databricks secrets are shown once. Generate a new client secret if it was not copied.
OAuth app not available immediately: Databricks says OAuth application updates can take up to 30 minutes to process.
Insufficient or mismatched scope: Compare Scopes (optional) in ChatGPT with Access scopes on the Databricks OAuth app. Every scope ChatGPT requests must be enabled there. For non-SQL APIs, confirm all-apis is enabled in Databricks and remains in the ChatGPT scope list.
SQL actions fail: Confirm the SQL scope, warehouse configuration, and Databricks permissions.
Wrong ChatGPT workspace: Create and enable the connector in the same ChatGPT workspace where users will connect it.
Wrong Databricks account or workspace: Confirm the Workspace hostname (required) value, then repeat the sign-in flow and verify that Databricks opens the expected account or workspace.
Users cannot connect: Confirm that the user has Databricks access and is allowed to authorize the OAuth app. Also confirm the user's ChatGPT User access permits the connector.
Databricks network policy blocks the connector: If Databricks allows only specific source IPs, a Databricks admin must update the relevant account or workspace IP access lists, context-based ingress controls, firewall, or other customer-controlled network rules.
Allow inbound connections from the current ChatGPT connector egress IP ranges.
Configure this allowlisting in Databricks or the customer-controlled network layer. It is separate from ChatGPT workspace IP allowlisting.
The published ranges can change. Automate updates from the JSON when possible.
Do not rotate the client secret or change OAuth scopes to work around a network block. First confirm whether Databricks is rejecting the connector's source IPs.