{"record":{"id":"87a83fefb53e4df5","repo":"chroma-core/chroma","slug":"your-api-key-does-not-have-access-to-any-dbs-for-t","errorCode":null,"errorMessage":"Your API key does not have access to any DBs for tenant ${this.tenant}","messagePattern":"Your API key does not have access to any DBs for tenant (.+?)","errorType":"exception","errorClass":"ChromaUnauthorizedError","httpStatus":null,"severity":"error","filePath":"clients/new-js/packages/chromadb/src/chroma-client.ts","lineNumber":196,"sourceCode":"\n  protected set preflightChecks(\n    preflightChecks: ChecklistResponse | undefined,\n  ) {\n    this._preflightChecks = preflightChecks;\n  }\n\n  public get headers(): Record<string, string> | undefined {\n    return this._headers;\n  }\n\n  /** @ignore */\n  public async _path(): Promise<{ tenant: string; database: string }> {\n    if (!this._tenant || !this._database) {\n      const { tenant, databases } = await this.getUserIdentity();\n      const uniqueDBs = [...new Set(databases)];\n      this._tenant = tenant;\n      if (uniqueDBs.length === 0) {\n        throw new ChromaUnauthorizedError(\n          `Your API key does not have access to any DBs for tenant ${this.tenant}`,\n        );\n      }\n      if (uniqueDBs.length > 1 || uniqueDBs[0] === \"*\") {\n        throw new ChromaValueError(\n          \"Your API key is scoped to more than 1 DB. Please provide a DB name to the CloudClient constructor\",\n        );\n      }\n      this._database = uniqueDBs[0];\n    }\n    return { tenant: this._tenant, database: this._database };\n  }\n\n  /**\n   * Gets the user identity information including tenant and accessible databases.\n   * @returns Promise resolving to user identity data\n   */\n  public async getUserIdentity(): Promise<UserIdentity> {","sourceCodeStart":178,"sourceCodeEnd":214,"githubUrl":"https://github.com/chroma-core/chroma/blob/aecdd12c8a891610db8653630b066b32ceb678b5/clients/new-js/packages/chromadb/src/chroma-client.ts#L178-L214","documentation":"Thrown by ChromaClient._path() (chroma-client.ts:196) when the client lazily resolves its tenant/database by calling getUserIdentity() and the returned database list, after deduplication, is empty. It is a ChromaUnauthorizedError: the API key authenticated successfully but is not granted access to any database in the tenant, so the client cannot determine which DB to target for subsequent requests.","triggerScenarios":"Using CloudClient (or any client that resolves tenant/database from the API key) without an explicit database, where the key's identity payload ({tenant, databases}) contains zero databases. Triggered on the first API call that needs _path(), e.g. listCollections(), createCollection(), or heartbeat via a scoped key.","commonSituations":"A freshly created Chroma Cloud API key whose project/tenant has no databases yet; a key scoped to a deleted database; a mis-scoped token issued for a different tenant; or IAM changes that revoked all DB grants after the client was configured.","solutions":["Create at least one database in the Chroma Cloud tenant (via the cloud console or the API), then retry.","Verify the key is for the right tenant/project by calling client.getUserIdentity() and inspecting {tenant, databases}.","If the key was narrowed intentionally, issue a key with access to the intended database or pass an explicit database to the client constructor so _path() never needs the identity lookup.","If databases were deleted, restore or recreate one, or rotate to a correctly scoped key."],"exampleFix":"// before\nconst client = new CloudClient({ apiKey: process.env.CHROMA_API_KEY });\nawait client.listCollections(); // throws ChromaUnauthorizedError: no DBs for tenant\n\n// after\nconst identity = await client.getUserIdentity();\nconsole.log(identity); // { tenant: \"...\", databases: [] }\n// create a DB in the cloud console, then:\nconst client2 = new CloudClient({ apiKey: process.env.CHROMA_API_KEY, database: \"my-db\" });","handlingStrategy":"validation","validationCode":"const identity = await client.getUserIdentity();\nif (!identity.databases?.length) {\n  throw new Error(`Key has no DB access (tenant ${identity.tenant}); create a database first`);\n}\nconst client2 = new CloudClient({ apiKey: KEY, tenant: identity.tenant, database: identity.databases[0] });","typeGuard":null,"tryCatchPattern":"try {\n  await client.listCollections();\n} catch (e) {\n  if (e instanceof ChromaUnauthorizedError && /does not have access to any DBs/.test(e.message)) {\n    // key authenticated but has zero DB grants: create a DB or re-scope the key\n  }\n  throw e;\n}","preventionTips":["Run getUserIdentity() once at startup to fail fast with a clear message.","Provision at least one database per tenant before issuing app API keys.","Alert on IAM/grant changes that can empty a key's database list."],"tags":["auth","cloud","tenant","api-key","authorization"],"backgroundTag":"api-key-no-resource-access","analyzedSha":"aecdd12c8a891610db8653630b066b32ceb678b5","analyzedAt":"2026-08-16T21:53:27.228Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}