cube-js/cube · error

Invalid credentials: No OAuth Client ID provided

Error message

Invalid credentials: No OAuth Client ID provided

What it means

A credential-validation guard in the Databricks JDBC driver constructor: when authenticating with OAuth (no personal access token resolved from conf.token, databricksToken env, or an embedded URL password), the driver requires an OAuth client ID from conf.oauthClientId or the databricksOAuthClientId env. Throwing here stops construction of a driver that could never connect. The input at fault is a Databricks config that supplies neither a token nor an OAuth client ID.

Source

Thrown at packages/cubejs-databricks-jdbc-driver/src/DatabricksDriver.ts:232

      conf?.url ||
      getEnv('databricksUrl', { dataSource, preAggregations }) ||
      getEnv('jdbcUrl', { dataSource, preAggregations });
    if (url.indexOf('jdbc:spark://') !== -1) {
      showSparkProtocolWarn = true;
      url = url.replace('jdbc:spark://', 'jdbc:databricks://');
    }

    const [uid, pwd, cleanedUrl] = extractAndRemoveUidPwdFromJdbcUrl(url);
    const passwd = conf?.token ||
          getEnv('databricksToken', { dataSource, preAggregations }) ||
          pwd;
    const oauthClientId = conf?.oauthClientId || getEnv('databricksOAuthClientId', { dataSource, preAggregations });
    const oauthClientSecret = conf?.oauthClientSecret || getEnv('databricksOAuthClientSecret', { dataSource, preAggregations });

    if (oauthClientId && !oauthClientSecret) {
      throw new Error('Invalid credentials: No OAuth Client Secret provided');
    } else if (!oauthClientId && oauthClientSecret) {
      throw new Error('Invalid credentials: No OAuth Client ID provided');
    } else if (!oauthClientId && !oauthClientSecret && !passwd) {
      throw new Error('No credentials provided');
    }

    let authProps: Record<string, any> = {};

    // OAuth has an advantage over UID+PWD
    // For magic numbers below - see Databricks docs:
    // https://docs.databricks.com/aws/en/integrations/jdbc-oss/configure#authenticate-the-driver
    if (oauthClientId) {
      authProps = {
        OAuth2ClientID: oauthClientId,
        OAuth2Secret: oauthClientSecret,
        AuthMech: 11,
        Auth_Flow: 1,
      };
    } else {
      authProps = {

View on GitHub (pinned to 7d981676b3)

Solutions

1. Provide oauthClientId in options or set DATABRICKS_OAUTH_CLIENT_ID
2. Confirm the env var is set in the process environment Cube runs in (not only the shell)
3. If only a token is intended, remove the stray oauthClientSecret
4. Check dataSource-scoped env naming so the right dataSource resolves both values

Example fix

// before
const driver = new DatabricksDriver({ url, oauthClientSecret: 'secret' });
// after
const driver = new DatabricksDriver({
  url,
  oauthClientId: process.env.DATABRICKS_OAUTH_CLIENT_ID,
  oauthClientSecret: 'secret',
});

const clientId = conf?.oauthClientId || process.env.DATABRICKS_OAUTH_CLIENT_ID;
const clientSecret = conf?.oauthClientSecret || process.env.DATABRICKS_OAUTH_CLIENT_SECRET;
if (clientSecret && !clientId) {
  throw new Error('DATABRICKS_OAUTH_CLIENT_ID must be set when OAuth client secret is used');
}

const hasValidOAuthPair = (c) =>
  Boolean(c?.oauthClientId) === Boolean(c?.oauthClientSecret);

try {
  driver = new DatabricksDriver(conf);
} catch (e) {
  if (/No OAuth Client ID provided/.test(e.message)) {
    throw new Error('Set DATABRICKS_OAUTH_CLIENT_ID in the deployment environment');
  }
  throw e;
}

When it happens

Trigger: new DatabricksDriver({...}) with oauthClientSecret (or DATABRICKS_OAUTH_CLIENT_SECRET) set but oauthClientId / DATABRICKS_OAUTH_CLIENT_ID missing.

Common situations: Secret provisioned via env/secret manager but the client ID not configured; OAuth vars added for one dataSource only (getEnv resolves per dataSource/preAggregations scope); typo in the client ID env var name.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid credentials: No OAuth Client Secret provided
• No credentials provided
• Unsupported configuration exportBucket, some configuration k
• Warehouse is being deleted (current state: ${data.state})
• A user-defined contextToApiScopes function returns an incons

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/58c67c5cc12ac696. Report an issue: GitHub.