chroma-core/chroma · error · ChromaUnauthorizedError

Your API key does not have access to any DBs for tenant ${th

Error message

Your API key does not have access to any DBs for tenant ${this.tenant}

What it means

Thrown by ChromaClient._path() (chroma-client.ts:196) when the client lazily resolves its tenant/database by calling getUserIdentity() and the returned database list, after deduplication, is empty. It is a ChromaUnauthorizedError: the API key authenticated successfully but is not granted access to any database in the tenant, so the client cannot determine which DB to target for subsequent requests.

Source

Thrown at clients/new-js/packages/chromadb/src/chroma-client.ts:196

  protected set preflightChecks(
    preflightChecks: ChecklistResponse | undefined,
  ) {
    this._preflightChecks = preflightChecks;
  }

  public get headers(): Record<string, string> | undefined {
    return this._headers;
  }

  /** @ignore */
  public async _path(): Promise<{ tenant: string; database: string }> {
    if (!this._tenant || !this._database) {
      const { tenant, databases } = await this.getUserIdentity();
      const uniqueDBs = [...new Set(databases)];
      this._tenant = tenant;
      if (uniqueDBs.length === 0) {
        throw new ChromaUnauthorizedError(
          `Your API key does not have access to any DBs for tenant ${this.tenant}`,
        );
      }
      if (uniqueDBs.length > 1 || uniqueDBs[0] === "*") {
        throw new ChromaValueError(
          "Your API key is scoped to more than 1 DB. Please provide a DB name to the CloudClient constructor",
        );
      }
      this._database = uniqueDBs[0];
    }
    return { tenant: this._tenant, database: this._database };
  }

  /**
   * Gets the user identity information including tenant and accessible databases.
   * @returns Promise resolving to user identity data
   */
  public async getUserIdentity(): Promise<UserIdentity> {

View on GitHub (pinned to aecdd12c8a)

Solutions

1. Create at least one database in the Chroma Cloud tenant (via the cloud console or the API), then retry.
2. Verify the key is for the right tenant/project by calling client.getUserIdentity() and inspecting {tenant, databases}.
3. If the key was narrowed intentionally, issue a key with access to the intended database or pass an explicit database to the client constructor so _path() never needs the identity lookup.
4. If databases were deleted, restore or recreate one, or rotate to a correctly scoped key.

Example fix

// before
const client = new CloudClient({ apiKey: process.env.CHROMA_API_KEY });
await client.listCollections(); // throws ChromaUnauthorizedError: no DBs for tenant

// after
const identity = await client.getUserIdentity();
console.log(identity); // { tenant: "...", databases: [] }
// create a DB in the cloud console, then:
const client2 = new CloudClient({ apiKey: process.env.CHROMA_API_KEY, database: "my-db" });

const identity = await client.getUserIdentity();
if (!identity.databases?.length) {
  throw new Error(`Key has no DB access (tenant ${identity.tenant}); create a database first`);
}
const client2 = new CloudClient({ apiKey: KEY, tenant: identity.tenant, database: identity.databases[0] });

try {
  await client.listCollections();
} catch (e) {
  if (e instanceof ChromaUnauthorizedError && /does not have access to any DBs/.test(e.message)) {
    // key authenticated but has zero DB grants: create a DB or re-scope the key
  }
  throw e;
}

When it happens

Trigger: Using CloudClient (or any client that resolves tenant/database from the API key) without an explicit database, where the key's identity payload ({tenant, databases}) contains zero databases. Triggered on the first API call that needs _path(), e.g. listCollections(), createCollection(), or heartbeat via a scoped key.

Common situations: A freshly created Chroma Cloud API key whose project/tenant has no databases yet; a key scoped to a deleted database; a mis-scoped token issued for a different tenant; or IAM changes that revoked all DB grants after the client was configured.

Related errors

• Your API key is scoped to more than 1 DB. Please provide a D
• Unauthorized
• Missing required arguments: {', '.join([arg.name for arg in
• Vertex AI and API key are mutually exclusive in the client i
• Credentials must be supplied via environment variable (CHROM

AI-assisted analysis of chroma-core/chroma@aecdd12c8a (2026-08-16). Data as JSON: /api/errors/87a83fefb53e4df5. Report an issue: GitHub.