# How does a delta sharing token rotation policy work?

opensilo.co · November 9, 2026

> What triggers token rotation in Delta Sharing? Token rotation in Delta Sharing is triggered by three main events: the approaching expiration of a...

## What triggers token rotation in Delta Sharing?

Token rotation in Delta Sharing is triggered by three main events: the approaching expiration of a recipient's bearer token, a suspected or confirmed security incident such as a leaked credential or departing employee, and scheduled policy mandates that require periodic refresh regardless of risk signals. Providers typically issue tokens with a fixed lifetime, and the rotation window opens shortly before that deadline, giving recipients time to act without interrupting live data access.

**Also worth reading:** [What are the security best practices for delta sharing?](https://opensilo.co/knowledge/what_are_the_security_best_practices_for_delta_sharing.php) · [How Can Secure Knowledge Sharing Help SMBs Work Smarter Across Teams?](https://opensilo.co/knowledge/how_can_secure_knowledge_sharing_help_smbs_work_smarter_across_teams.php) · [What should a UK data sharing agreement template include?](https://opensilo.co/knowledge/what_should_a_uk_data_sharing_agreement_template_include.php)

A rotation policy works by having the recipient generate a fresh token through the provider's console or API, distribute it securely to authorized consumers, and revoke the old credential once the new one is confirmed active. Well-designed policies include an overlap period so pipelines keep running, automated alerts that flag tokens nearing expiry, and audit logs that tie every rotation to a documented reason. This turns rotation from an ad-hoc emergency response into a routine, verifiable control that limits how long any single credential can be abused.

## How often should enterprises rotate shared tokens?

Enterprises should treat shared-token rotation as a risk-tiering decision rather than a single calendar rule. Broad or privileged access warrants rotation every 30 to 60 days, while narrowly scoped, read-only partner feeds can safely run 90 days. Any event—departing administrator, lost device, partner offboarding, anomalous access, or suspected exposure—should trigger immediate rotation outside the schedule. The policy must record owner, scope, expiry, and last-used data so frequent rotation does not become blind churn.

A Delta Sharing rotation policy settles the overlap problem: issue the replacement token before the old one expires, allow a defined grace period—typically 24 to 72 hours—during which both are valid, monitor old-token use, then revoke it automatically. For emergency rotation, skip the overlap and require consumers to re-authenticate immediately. Automation should propagate revocations to every sharing endpoint, alert on failed exchanges, and log each rotation with actor, reason, and timestamp. This makes rotation predictable for partners while closing the window in which a leaked token remains useful.

## Which credentials stay valid during rotation windows?

During a Delta Sharing token rotation window, the old recipient bearer token remains valid until its configured expiration or explicit revocation; issuing a replacement does not invalidate it retroactively. The new token is accepted as soon as it is activated, so both credentials can work during the overlap. That overlap is intentional: it lets consumers update connectors, secret stores, and scheduled jobs without breaking reads. Access is still constrained by the share grants and recipient identity associated with each token, not by token age alone.

The unresolved point is revocation versus expiry. A rotation policy should treat expiry as graceful overlap and revocation as immediate cutover. If an enterprise needs a hard boundary, it must revoke the old token rather than rely on the new token's issuance. In an OpenSilo-style secure exchange, that means documenting the overlap period, monitoring token use, and ensuring downstream caches never treat an expired token as renewable. That settles which credentials stay valid: both tokens during the overlap, while the old token ends at expiry or revocation and the new token follows its own lifetime.

## How do recipients handle rotation without downtime?

Recipients avoid downtime by treating the bearer token as a renewable credential rather than a static secret. Delta Sharing clients typically fetch a fresh token from the recipient credential file before the current one expires, often on a schedule that triggers well ahead of the expiration window. Because the old token remains valid until its stated expiry, there is a graceful overlap period: the recipient can begin using the new token while the previous one still authenticates requests. Applications that maintain long-lived connections simply refresh the token in memory and continue streaming without dropping sessions.

The practical pattern is to automate rotation through the SDK or a secrets manager, so the credential file is re-read or the token is refreshed transparently on the client side. Providers never need to coordinate with recipients manually, since rotation happens on the provider's schedule and recipients adapt automatically. The only failure mode is a recipient ignoring refresh entirely, which surfaces as authentication errors after expiry rather than mid-session interruption.

## What audit evidence proves rotation policy compliance?

A delta sharing token rotation policy works by periodically replacing the bearer token embedded in a recipient's profile with a freshly issued credential, then revoking the old one. Databricks security best practices for Delta Sharing recommend short token lifespans and regular rotation, and the open question many enterprises face is whether the previous token keeps working until it expires or is cut off the moment rotation happens. In practice the old token is invalidated at rotation, so any connection attempt using it fails authentication immediately.

What proves compliance is the audit trail behind each rotation: token issuance and revocation timestamps, the identity of the actor who triggered the change, and recipient profile records showing updated expiration dates. Reviewers compare those logs against the policy cadence to confirm credentials were replaced within the required window and that superseded tokens were deactivated rather than left active in parallel. Red flags include tokens living past their maximum age, rotation events with no matching revocation entry, or gaps where a recipient kept working uninterrupted because both credentials were valid simultaneously.

## Rotation methods compared

| Rotation method | How it works | Best suited for |
| --- | --- | --- |
| Manual rotation | Admins generate a new bearer token, update recipient configs, and revoke the old credential on a fixed schedule | Small teams with few recipients and low sharing volume |
| Scheduled automatic rotation | The platform expires and reissues tokens at a set interval (e.g., every 90 days) without admin action | Enterprises with many recipients needing predictable credential lifecycles |
| Event-driven rotation | Tokens are rotated when triggers fire — recipient onboarding, policy changes, or suspected compromise | High-security environments with audit and compliance requirements |
| Short-lived ephemeral tokens | Credentials are issued per session or per query and expire within minutes | Machine-to-machine exchanges and real-time data feeds |

Delta Sharing uses bearer tokens that recipients present to access shared tables, so rotation policy determines how long a leaked credential remains usable. Effective policies combine automatic expiry with immediate revocation capability, ensuring a compromised token can be invalidated instantly rather than waiting for its natural lifecycle. Pair rotation with recipient-level activity logs so anomalous token use is detected before scheduled renewal, and document ownership of each credential so accountability survives team turnover.

## Quick answers

### Does rotating a token immediately cut off recipients?

No, overlapping validity and dual-token grace periods let recipients switch before old credentials expire.

### Are refresh tokens subject to the same rotation rules?

Refresh tokens usually rotate with stricter lifetimes because they can mint new access tokens.

### Can automation rotate tokens without human approval?

Yes, but production rotation should require policy checks, audit logging, and break-glass controls.

### What happens to in-flight queries during token rotation?

Short-lived sessions may finish, while new requests must use the replacement credential.

Canonical: https://opensilo.co/knowledge/how_does_a_delta_sharing_token_rotation_policy_work.php
Markdown: https://opensilo.co/knowledge/how_does_a_delta_sharing_token_rotation_policy_work.php/index.md