{"record":{"id":"b746b4237139ac63","repo":"pola-rs/polars","slug":"did-not-receive-credentials-from-temporary-credent","errorCode":null,"errorMessage":"did not receive credentials from temporary credentials API for {table_id = }","messagePattern":"did not receive credentials from temporary credentials API for (.+?)","errorType":"exception","errorClass":"Exception","httpStatus":null,"severity":"error","filePath":"py-polars/src/polars/catalog/unity/client.py","lineNumber":741,"sourceCode":"\n    def __call__(self) -> CredentialProviderFunctionReturn:  # noqa: D102\n        _, (creds, expiry) = self._credentials_iter()\n        return creds, expiry\n\n    def _credentials_iter(self) -> Generator[Any]:\n        creds, storage_update_options, expiry = self.catalog._get_table_credentials(\n            self.table_id, write=self.write\n        )\n\n        yield storage_update_options\n\n        if not creds:\n            table_id = self.table_id\n            msg = (\n                \"did not receive credentials from temporary credentials API for \"\n                f\"{table_id = }\"\n            )\n            raise Exception(msg)  # noqa: TRY002\n\n        yield creds, expiry\n\n\ndef _extract_location_and_data_format(\n    table_info: TableInfo, operation: str\n) -> tuple[str, DataSourceFormat]:\n    if table_info.storage_location is None:\n        msg = f\"cannot {operation}: no storage_location found\"\n        raise ValueError(msg)\n\n    if table_info.data_source_format is None:\n        msg = f\"cannot {operation}: no data_source_format found\"\n        raise ValueError(msg)\n\n    return table_info.storage_location, table_info.data_source_format\n","sourceCodeStart":723,"sourceCodeEnd":758,"githubUrl":"https://github.com/pola-rs/polars/blob/df599052daf96e7a9cc30a3b0c6bd25d6947e3c0/py-polars/src/polars/catalog/unity/client.py#L723-L758","documentation":"Generic Exception from CatalogCredentialProvider (py-polars/src/polars/catalog/unity/client.py:729-743). For Unity Catalog tables whose underlying storage requires temporary credentials, polars calls the catalog's temporary-credentials API with the table_id; if that API answers with empty/absent credentials, the provider yields nothing usable and this error is raised, naming the table_id. It is a server-side/authorization outcome rather than a client bug: the API responded but granted no credentials for that table and operation (read vs write).","triggerScenarios":"catalog.read_table('cat.ns.tbl') or write_table on a table with credential-vending enabled where the API returns no creds: missing SELECT/ALL privileges on the table or its storage credential, wrong credential mode, or an internal/external location not enabled for the calling principal.","commonSituations":"Service principals without metastore privileges; WRITE privilege missing when write=True (the _get_table_credentials(write=...) path); environment-specific grants that differ between dev and prod; tables backed by external locations the caller cannot access.","solutions":["Verify the caller has the needed privilege on the table (SELECT for reads, MODIFY/WRITE for writes) in Unity Catalog","Check that the external location / storage credential is enabled for your principal and the table's operation mode","Retry after fixing grants — an intermittent empty response can also come from metastore issues, but treat missing permissions as the primary cause","If credentials are not required (public/credentialed storage), prefer passing storage_options directly"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try:\n    ldf = catalog.read_table(f'{cat}.{ns}.{tbl}')\nexcept Exception as e:\n    msg = str(e)\n    if 'did not receive credentials' in msg:\n        raise PermissionError(f'no temp credentials for {tbl}: check grants') from e\n    raise","preventionTips":["Grant the calling principal SELECT (read) and MODIFY (write) on the table before scanning","Ensure the external location/storage credential is usable by that principal for the table's path","Distinguish read vs write credential needs — write=True requests stronger creds","Surface credential failures as permission errors in wrappers so on-call can act on grants"],"tags":["polars","unity-catalog","credentials","authorization","databricks"],"backgroundTag":null,"analyzedSha":"df599052daf96e7a9cc30a3b0c6bd25d6947e3c0","analyzedAt":"2026-08-16T12:10:03.978Z","schemaVersion":2},"datasetVersion":"2026-08-16T13:17:31.715Z"}