Restrict service principal OAuth secrets to specific API scopes

You can now restrict a service principal's OAuth secret to specific API scopes, such as sql or jobs, instead of all APIs. A token minted from a scoped secret can't exceed those scopes, which limits the impact of a leaked secret. This page explains how to authorize access to Databricks resources from unattended processes, such as automated CLI commands or REST API calls made from scripts or applications.