{"record":{"id":"58c67c5cc12ac696","repo":"cube-js/cube","slug":"invalid-credentials-no-oauth-client-id-provided","errorCode":null,"errorMessage":"Invalid credentials: No OAuth Client ID provided","messagePattern":"Invalid credentials: No OAuth Client ID provided","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cubejs-databricks-jdbc-driver/src/DatabricksDriver.ts","lineNumber":232,"sourceCode":"      conf?.url ||\n      getEnv('databricksUrl', { dataSource, preAggregations }) ||\n      getEnv('jdbcUrl', { dataSource, preAggregations });\n    if (url.indexOf('jdbc:spark://') !== -1) {\n      showSparkProtocolWarn = true;\n      url = url.replace('jdbc:spark://', 'jdbc:databricks://');\n    }\n\n    const [uid, pwd, cleanedUrl] = extractAndRemoveUidPwdFromJdbcUrl(url);\n    const passwd = conf?.token ||\n          getEnv('databricksToken', { dataSource, preAggregations }) ||\n          pwd;\n    const oauthClientId = conf?.oauthClientId || getEnv('databricksOAuthClientId', { dataSource, preAggregations });\n    const oauthClientSecret = conf?.oauthClientSecret || getEnv('databricksOAuthClientSecret', { dataSource, preAggregations });\n\n    if (oauthClientId && !oauthClientSecret) {\n      throw new Error('Invalid credentials: No OAuth Client Secret provided');\n    } else if (!oauthClientId && oauthClientSecret) {\n      throw new Error('Invalid credentials: No OAuth Client ID provided');\n    } else if (!oauthClientId && !oauthClientSecret && !passwd) {\n      throw new Error('No credentials provided');\n    }\n\n    let authProps: Record<string, any> = {};\n\n    // OAuth has an advantage over UID+PWD\n    // For magic numbers below - see Databricks docs:\n    // https://docs.databricks.com/aws/en/integrations/jdbc-oss/configure#authenticate-the-driver\n    if (oauthClientId) {\n      authProps = {\n        OAuth2ClientID: oauthClientId,\n        OAuth2Secret: oauthClientSecret,\n        AuthMech: 11,\n        Auth_Flow: 1,\n      };\n    } else {\n      authProps = {","sourceCodeStart":214,"sourceCodeEnd":250,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-databricks-jdbc-driver/src/DatabricksDriver.ts#L214-L250","documentation":"A credential-validation guard in the Databricks JDBC driver constructor: when authenticating with OAuth (no personal access token resolved from conf.token, databricksToken env, or an embedded URL password), the driver requires an OAuth client ID from conf.oauthClientId or the databricksOAuthClientId env. Throwing here stops construction of a driver that could never connect. The input at fault is a Databricks config that supplies neither a token nor an OAuth client ID.","triggerScenarios":"new DatabricksDriver({...}) with oauthClientSecret (or DATABRICKS_OAUTH_CLIENT_SECRET) set but oauthClientId / DATABRICKS_OAUTH_CLIENT_ID missing.","commonSituations":"Secret provisioned via env/secret manager but the client ID not configured; OAuth vars added for one dataSource only (getEnv resolves per dataSource/preAggregations scope); typo in the client ID env var name.","solutions":["Provide oauthClientId in options or set DATABRICKS_OAUTH_CLIENT_ID","Confirm the env var is set in the process environment Cube runs in (not only the shell)","If only a token is intended, remove the stray oauthClientSecret","Check dataSource-scoped env naming so the right dataSource resolves both values"],"exampleFix":"// before\nconst driver = new DatabricksDriver({ url, oauthClientSecret: 'secret' });\n// after\nconst driver = new DatabricksDriver({\n  url,\n  oauthClientId: process.env.DATABRICKS_OAUTH_CLIENT_ID,\n  oauthClientSecret: 'secret',\n});","handlingStrategy":"validation","validationCode":"const clientId = conf?.oauthClientId || process.env.DATABRICKS_OAUTH_CLIENT_ID;\nconst clientSecret = conf?.oauthClientSecret || process.env.DATABRICKS_OAUTH_CLIENT_SECRET;\nif (clientSecret && !clientId) {\n  throw new Error('DATABRICKS_OAUTH_CLIENT_ID must be set when OAuth client secret is used');\n}","typeGuard":"const hasValidOAuthPair = (c) =>\n  Boolean(c?.oauthClientId) === Boolean(c?.oauthClientSecret);","tryCatchPattern":"try {\n  driver = new DatabricksDriver(conf);\n} catch (e) {\n  if (/No OAuth Client ID provided/.test(e.message)) {\n    throw new Error('Set DATABRICKS_OAUTH_CLIENT_ID in the deployment environment');\n  }\n  throw e;\n}","preventionTips":["Configure OAuth ID and secret as an atomic pair in env/secret management","Check dataSource-scoped env names — the ID may be missing for the specific dataSource","Smoke-test driver construction at startup in CI","Document required Databricks env vars in deployment runbooks"],"tags":["databricks","oauth","configuration","credentials"],"backgroundTag":"oauth-missing-client-id","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}