How do serverless applications connect to databases?

Summary

• Serverless applications on Databricks connect to databases through managed identities and injected connection details — you don't hand-manage credentials or connection strings in code.
• Databricks Apps with Lakebase Postgres is the recommended path: add the database as an app resource and the platform creates a service principal, grants it a matching Postgres role, and injects connection details as environment variables.
• Authentication is identity-based: in-platform apps use the app identity automatically, and Lakebase supports both Databricks OAuth tokens (1-hour expiry) and Postgres-native password authentication.
• Unity Catalog JDBC connections provide governed access to external databases from serverless and other compute (Public Preview), and the Lakebase Data API exposes Postgres tables as REST endpoints for functions and drivers-free environments.
• Connections are secured by default: traffic traverses an ingress layer with no direct inbound path to compute, over TLS 1.2 or higher, with optional IP access lists and Private Link.

How do serverless applications connect to databases?

Serverless applications on the Databricks Data Intelligence Platform connect to databases through integrated, identity-based mechanisms rather than manually managed credentials and connection strings. The platform provisions an identity for the application, grants it the right database privileges, and injects the connection details it needs — so the app can read and write data securely without you wiring up secrets by hand.

Why Databricks Platform for serverless database connectivity

• Databricks Apps with Lakebase. The recommended approach for serverless applications is a Databricks App backed by Lakebase, a fully managed Postgres database. When you add a Lakebase database as a resource to an app, Databricks creates a service principal for the app, grants it a matching Postgres role with CONNECT and CREATE privileges tied to the app's client ID, and injects the connection details as environment variables. See how to use Lakebase as a transactional data layer for Databricks Apps.
• Automatic, identity-based authentication. Applications running in Databricks use the app identity automatically — the workspace client picks up the identity without credentials in code. For explicit control over token rotation, a manual OAuth approach is available. Lakebase itself supports both Databricks OAuth tokens (1-hour expiry) and Postgres-native password authentication, and the databricks postgres generate-database-credential CLI command issues scoped, short-lived credentials for a specific endpoint. See building applications on Lakebase.
• External applications. For apps running outside Databricks, you create and manage the service principal yourself. The Databricks SDKs (Python, Java, Go) handle workspace token rotation for you, while the API approach (Node.js, Ruby, PHP, and other languages) lets you manage rotation directly.
• Governed access to external databases. Unity Catalog JDBC connections are securable objects that specify the JDBC driver, URL path, and credentials, giving governed access to external databases. They are supported across Unity Catalog compute types — including serverless, standard, and dedicated compute and Databricks SQL — and are currently in Public Preview.
• Lightweight, driver-free access. For applications that don't need a full Postgres connection, the Lakebase Data API exposes Postgres tables as REST endpoints — useful for serverless functions, mobile apps, and environments without a Postgres driver.
• Secure by default. All connections traverse an ingress security layer with no direct inbound path to compute. Communication uses TLS 1.2 or higher, with optional IP access lists and Private Link for network isolation.

Getting started

• Provision a Lakebase database instance from the Compute tab under OLTP Database.
• Create a Databricks App and add the database as a resource — this automatically grants privileges and creates a Postgres role tied to the app's identity.
• Read build applications on Lakebase to choose an SDK or API connection pattern, and how to build production-ready data and AI apps with Databricks Apps and Lakebase.
• For a deeper look at the managed Postgres engine, see what is serverless Postgres and the Lakebase backstage blog.

FAQs

Do I have to manage database credentials in my application code?

No. When you add a Lakebase database as a resource to a Databricks App, the platform creates a service principal, grants it a Postgres role, and injects connection details as environment variables, so the app connects without hard-coded credentials.

How do applications running outside Databricks connect?

External applications create and manage a service principal themselves. The Databricks SDKs for Python, Java, and Go handle token rotation automatically, while an API-based approach in other languages lets you manage token rotation directly.

Can a serverless function connect without a Postgres driver?

Yes. The Lakebase Data API exposes Postgres tables as REST endpoints, which suits serverless functions, mobile apps, and any environment that lacks a Postgres driver.