how do i build a customer facing app on my companys data

Summary

• Build it as a Databricks App: a web app hosted on Databricks that runs next to your governed data, written in a Python framework (Streamlit, Dash, Gradio) or Node.js and React, with no separate infrastructure to provision.
• Know the one hard constraint: Databricks Apps require every user to sign in, so they can't be anonymous public websites. Customer-facing works for known external customers and partners you provision, not for an open consumer audience.
• Serve external users through your identity provider. Onboard external customers or partners into your Databricks account with SCIM and just-in-time provisioning, then grant them app access; they sign in with SSO like any other user.
• Access company data through Unity Catalog using either the app's service principal (a shared identity) or the signed-in user's identity (which respects that user's own permissions), and connect to SQL warehouses, Model Serving, and Genie.
• For a truly public, anonymous audience, build a separate front end and use Databricks as the governed backend for data and model serving.

how do i build a customer facing app on my companys data

Build it as a Databricks App: a web application that runs on Databricks, right next to the governed data it uses. You write the app in a common framework, connect it to your data through Unity Catalog, and Databricks hosts it with no separate servers to run. One constraint shapes the whole design: every Databricks App user must sign in, so an app can't be an anonymous public website. If customer-facing means a known set of external customers or partners, that works well; you provision them through your identity provider and they sign in with SSO. If it means an open, anonymous consumer audience, build a separate front end and use Databricks as the governed backend behind it.

What are Databricks Apps?

Databricks Apps are managed web apps hosted on the platform. You can build them with Python frameworks like Streamlit, Dash, and Gradio, or with Node.js and React. The app runs next to your data and models, authenticates users through your workspace identity provider, and reaches data through Unity Catalog, so you don't stand up separate hosting, wire up your own login, or copy data out to another tier. See the Databricks Apps documentation.

How to build one on your data

1. Pick a framework and scaffold the app. Start from a template in your chosen framework and develop locally or in the workspace.
2. Connect to governed data. Point the app at Unity Catalog tables through a SQL warehouse, and add Model Serving endpoints or connect to Genie if the app needs predictions or natural-language querying.
3. Choose the identity model. Decide whether each data call runs as the app itself or as the signed-in user (see the next section).
4. Set permissions and deploy. Grant CAN_USE or CAN_MANAGE on the app to the right users or groups, then deploy. Databricks injects the app's service principal credentials as environment variables, so you never hardcode secrets.

Serving external customers: identity and access

Every user authenticates; anonymous access and single-sign-on bypass aren't supported. What customer-facing means decides the pattern.

Audience	Supported as a Databricks App?	How it works
Internal employees	Yes	Sign in with workspace SSO; no separate login to build
Named external customers or partners	Yes, once provisioned	Onboard them into your account through your identity provider with SCIM and just-in-time provisioning, then grant app permissions
Anonymous public visitors	No	Apps can't be public; build a separate front end that calls Databricks as a governed backend

Two authorization models control data access. With app authorization, the app acts as its own service principal, a shared identity useful for work that doesn't depend on who is signed in. With user authorization, the app acts on behalf of the signed-in user, so access to a SQL warehouse or a Model Serving endpoint follows that user's own Unity Catalog permissions. Apps request specific OAuth scopes in their manifest to limit which resources they can reach. For the details, see app authorization and configure permissions.

FAQs

Can a Databricks App be a public, anonymous website?

No. Every user must sign in, and bypassing SSO isn't supported. For an anonymous consumer audience, build a separate front end and use Databricks as the governed backend for data and model serving.

How do external customers or partners get access?

Provision them into your Databricks account through your identity provider using SCIM and just-in-time provisioning, then grant CAN_USE on the app. They sign in with SSO and don't need full workspace access.

How does the app read my company's data safely?

Through Unity Catalog. The app connects with either its own service principal or the signed-in user's identity, so every query is subject to the same governance, lineage, and access controls as the rest of your data.

What languages and frameworks can I use?

Python frameworks such as Streamlit, Dash, and Gradio, or Node.js and React. Databricks hosts the app and manages the runtime, so you focus on the app code instead of infrastructure.

Can the app use AI or natural-language features?

Yes. Apps can call Model Serving endpoints for predictions and connect to Genie so users can ask questions in natural language, all governed through Unity Catalog.