{"record":{"id":"9907b55133d70598","repo":"chroma-core/chroma","slug":"could-not-determine-a-tenant-from-the-current-auth","errorCode":null,"errorMessage":"Could not determine a tenant from the current authentication method. Please provide a tenant.","messagePattern":"Could not determine a tenant from the current authentication method\\. Please provide a tenant\\.","errorType":"exception","errorClass":"ChromaAuthError","httpStatus":null,"severity":"error","filePath":"chromadb/api/client.py","lineNumber":99,"sourceCode":"                self.tenant = tenant\n            if database is not None:\n                self.database = database\n\n            # Get the root system component we want to interact with\n            self._server = self._system.instance(ServerAPI)\n\n            user_identity = self.get_user_identity()\n\n            maybe_tenant, maybe_database = maybe_set_tenant_and_database(\n                user_identity,\n                overwrite_singleton_tenant_database_access_from_auth=settings.chroma_overwrite_singleton_tenant_database_access_from_auth,\n                user_provided_tenant=tenant,\n                user_provided_database=database,\n            )\n\n            # this should not happen unless types are invalidated\n            if maybe_tenant is None and tenant is None:\n                raise ChromaAuthError(\n                    \"Could not determine a tenant from the current authentication method. Please provide a tenant.\"\n                )\n            if maybe_database is None and database is None:\n                raise ChromaAuthError(\n                    \"Could not determine a database name from the current authentication method. Please provide a database name.\"\n                )\n\n            if maybe_tenant:\n                self.tenant = maybe_tenant\n            if maybe_database:\n                self.database = maybe_database\n\n            # Create an admin client for verifying that databases and tenants exist\n            self._admin_client = AdminClient.from_system(self._system)\n            self._validate_tenant_database(tenant=self.tenant, database=self.database)\n\n            self._submit_client_start_event()\n        except Exception:","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/chroma-core/chroma/blob/aecdd12c8a891610db8653630b066b32ceb678b5/chromadb/api/client.py#L81-L117","documentation":"During synchronous Client construction with authentication enabled, Chroma fetches the user identity and calls maybe_set_tenant_and_database() to derive a tenant from the auth method (e.g. JWT claims). If the identity yields no tenant and the caller did not pass tenant=, init fails with ChromaAuthError. The code comment says this 'should not happen unless types are invalidated' — in practice it means the token/credentials carry no tenant information.","triggerScenarios":"Token auth (CHROMA_AUTH_TOKEN_TRANSPORT_HEADER etc.) where the JWT has no tenant claim and Client() is constructed without tenant=; an auth provider whose get_user_identity() returns an identity without tenant info; a credentials file that omits the tenant.","commonSituations":"Chroma RBAC/token deployments where the issued token is generic; rolling out authentication on an existing app that never passed tenant; switching auth providers without updating issued tokens.","solutions":["Pass the tenant explicitly: Client(tenant=\"my_tenant\", database=\"my_db\").","Re-issue the token/credentials so they include the tenant claim the provider expects.","Check the auth configuration (CHROMA_SERVER_AUTHN_PROVIDER, credentials file contents, chroma_overwrite_singleton_tenant_database_access_from_auth) matches the deployment."],"exampleFix":"# before\nclient = chromadb.HttpClient(settings=auth_settings)  # token lacks tenant claim -> ChromaAuthError\n\n# after\nclient = chromadb.HttpClient(settings=auth_settings, tenant=\"acme\", database=\"prod\")","handlingStrategy":"validation","validationCode":"import base64, json\n\ndef jwt_has_tenant(token: str) -> bool:\n    try:\n        payload = token.split(\".\")[1]\n        claims = json.loads(base64.urlsafe_b64decode(payload + \"=\" * (-len(payload) % 4)))\n        return \"tenant\" in claims\n    except Exception:\n        return False\n\nif not jwt_has_tenant(os.environ[\"CHROMA_TOKEN\"]):\n    tenant = \"acme\"  # pass explicitly: Client(tenant=tenant, ...)","typeGuard":null,"tryCatchPattern":"from chromadb.errors import ChromaAuthError\n\ntry:\n    client = chromadb.HttpClient(settings=auth_settings)\nexcept ChromaAuthError as e:\n    if \"tenant\" in str(e):\n        client = chromadb.HttpClient(settings=auth_settings, tenant=\"acme\")\n    else:\n        raise","preventionTips":["Always pass tenant= (and database=) explicitly when using token auth.","Verify issued tokens contain tenant claims before shipping them.","Smoke-test client construction in CI with the real auth settings."],"tags":["chroma","authentication","tenant","rbac","client-init"],"backgroundTag":"authentication-configuration","analyzedSha":"aecdd12c8a891610db8653630b066b32ceb678b5","analyzedAt":"2026-08-16T21:53:27.228Z","schemaVersion":2},"datasetVersion":"2026-08-16T23:17:17.608Z"}