{"record":{"id":"b92055aad9a33080","repo":"cube-js/cube","slug":"no-credentials-provided","errorCode":null,"errorMessage":"No credentials provided","messagePattern":"No credentials provided","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/cubejs-databricks-jdbc-driver/src/DatabricksDriver.ts","lineNumber":234,"sourceCode":"      getEnv('jdbcUrl', { dataSource, preAggregations });\n    if (url.indexOf('jdbc:spark://') !== -1) {\n      showSparkProtocolWarn = true;\n      url = url.replace('jdbc:spark://', 'jdbc:databricks://');\n    }\n\n    const [uid, pwd, cleanedUrl] = extractAndRemoveUidPwdFromJdbcUrl(url);\n    const passwd = conf?.token ||\n          getEnv('databricksToken', { dataSource, preAggregations }) ||\n          pwd;\n    const oauthClientId = conf?.oauthClientId || getEnv('databricksOAuthClientId', { dataSource, preAggregations });\n    const oauthClientSecret = conf?.oauthClientSecret || getEnv('databricksOAuthClientSecret', { dataSource, preAggregations });\n\n    if (oauthClientId && !oauthClientSecret) {\n      throw new Error('Invalid credentials: No OAuth Client Secret provided');\n    } else if (!oauthClientId && oauthClientSecret) {\n      throw new Error('Invalid credentials: No OAuth Client ID provided');\n    } else if (!oauthClientId && !oauthClientSecret && !passwd) {\n      throw new Error('No credentials provided');\n    }\n\n    let authProps: Record<string, any> = {};\n\n    // OAuth has an advantage over UID+PWD\n    // For magic numbers below - see Databricks docs:\n    // https://docs.databricks.com/aws/en/integrations/jdbc-oss/configure#authenticate-the-driver\n    if (oauthClientId) {\n      authProps = {\n        OAuth2ClientID: oauthClientId,\n        OAuth2Secret: oauthClientSecret,\n        AuthMech: 11,\n        Auth_Flow: 1,\n      };\n    } else {\n      authProps = {\n        UID: uid,\n        PWD: passwd,","sourceCodeStart":216,"sourceCodeEnd":252,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/packages/cubejs-databricks-jdbc-driver/src/DatabricksDriver.ts#L216-L252","documentation":"With no OAuth pair and no password/token, the driver has no usable authentication and throws 'No credentials provided' at construction time. This is the exhaust case of the driver's credential validation chain.","triggerScenarios":"new DatabricksDriver({...}) where conf has no oauthClientId/oauthClientSecret and password is empty: no pwd option, no databricksToken/databricksPassword env (for the relevant dataSource/preAggregations scope).","commonSituations":"Deploying without any Databricks env vars configured; env vars set under wrong names or wrong dataSource scope; secrets stripped in CI; migrating from local .env to production where envs were not carried over.","solutions":["Set DATABRICKS_TOKEN (or pass pwd/token option) for token auth","Or configure the full OAuth pair: oauthClientId + oauthClientSecret (plus the required OAuth envs)","Verify env vars in the actual Cube process (print/inspect env at startup in a safe way)","Check getEnv dataSource scoping so credentials match the dataSource being used"],"exampleFix":"// before\nnew DatabricksDriver({ url }); // no credentials anywhere\n// after\nnew DatabricksDriver({ url, pwd: process.env.DATABRICKS_TOKEN });\n// or full OAuth\nnew DatabricksDriver({\n  url,\n  oauthClientId: process.env.DATABRICKS_OAUTH_CLIENT_ID,\n  oauthClientSecret: process.env.DATABRICKS_OAUTH_CLIENT_SECRET,\n});","handlingStrategy":"validation","validationCode":"const hasCreds = Boolean(\n  conf?.pwd || conf?.token || process.env.DATABRICKS_TOKEN ||\n  ((conf?.oauthClientId || process.env.DATABRICKS_OAUTH_CLIENT_ID) &&\n   (conf?.oauthClientSecret || process.env.DATABRICKS_OAUTH_CLIENT_SECRET))\n);\nif (!hasCreds) throw new Error('Databricks: set DATABRICKS_TOKEN or full OAuth pair before starting Cube');","typeGuard":"const hasAnyCredential = (c) =>\n  Boolean(c?.pwd || c?.token || process.env.DATABRICKS_TOKEN ||\n    ((c?.oauthClientId || process.env.DATABRICKS_OAUTH_CLIENT_ID) &&\n     (c?.oauthClientSecret || process.env.DATABRICKS_OAUTH_CLIENT_SECRET)));","tryCatchPattern":"try {\n  driver = new DatabricksDriver(conf);\n} catch (e) {\n  if (/No credentials provided/.test(e.message)) {\n    throw new Error('Databricks driver requires DATABRICKS_TOKEN (pwd) or an OAuth client id/secret pair');\n  }\n  throw e;\n}","preventionTips":["Set DATABRICKS_TOKEN in the environment Cube actually runs in (container/CI), not just your shell","Validate credential presence at app bootstrap before serving queries","Check env var names and per-dataSource scoping after migrations","Keep a startup health-check that constructs each driver once"],"tags":["databricks","credentials","configuration","env"],"backgroundTag":"no-credentials-provided","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}