cube-js/cube · error

Invalid credentials: No OAuth Client Secret provided

Error message

Invalid credentials: No OAuth Client Secret provided

What it means

The Databricks JDBC driver validates credential completeness at construction time: an OAuth client ID was supplied (option or env) but no OAuth client secret. OAuth requires both, so the driver fails fast with Invalid credentials instead of producing a broken JDBC connection later.

Source

Thrown at packages/cubejs-databricks-jdbc-driver/src/DatabricksDriver.ts:230

    let showSparkProtocolWarn = false;
    let url: string =
      conf?.url ||
      getEnv('databricksUrl', { dataSource, preAggregations }) ||
      getEnv('jdbcUrl', { dataSource, preAggregations });
    if (url.indexOf('jdbc:spark://') !== -1) {
      showSparkProtocolWarn = true;
      url = url.replace('jdbc:spark://', 'jdbc:databricks://');
    }

    const [uid, pwd, cleanedUrl] = extractAndRemoveUidPwdFromJdbcUrl(url);
    const passwd = conf?.token ||
          getEnv('databricksToken', { dataSource, preAggregations }) ||
          pwd;
    const oauthClientId = conf?.oauthClientId || getEnv('databricksOAuthClientId', { dataSource, preAggregations });
    const oauthClientSecret = conf?.oauthClientSecret || getEnv('databricksOAuthClientSecret', { dataSource, preAggregations });

    if (oauthClientId && !oauthClientSecret) {
      throw new Error('Invalid credentials: No OAuth Client Secret provided');
    } else if (!oauthClientId && oauthClientSecret) {
      throw new Error('Invalid credentials: No OAuth Client ID provided');
    } else if (!oauthClientId && !oauthClientSecret && !passwd) {
      throw new Error('No credentials provided');
    }

    let authProps: Record<string, any> = {};

    // OAuth has an advantage over UID+PWD
    // For magic numbers below - see Databricks docs:
    // https://docs.databricks.com/aws/en/integrations/jdbc-oss/configure#authenticate-the-driver
    if (oauthClientId) {
      authProps = {
        OAuth2ClientID: oauthClientId,
        OAuth2Secret: oauthClientSecret,
        AuthMech: 11,
        Auth_Flow: 1,
      };

View on GitHub (pinned to 7d981676b3)

Solutions

1. Provide oauthClientSecret in the driver options or set DATABRICKS_OAUTH_CLIENT_SECRET
2. Verify the secret is present in the deployment environment (CI, K8s secret, .env)
3. If you intended token auth instead, remove the oauthClientId so password/token auth is used
4. Check per-dataSource/preAggregations env resolution — the secret may be defined only for a different dataSource

Example fix

// before
const driver = new DatabricksDriver({ url, oauthClientId: 'id' });
// after
const driver = new DatabricksDriver({
  url,
  oauthClientId: 'id',
  oauthClientSecret: process.env.DATABRICKS_OAUTH_CLIENT_SECRET,
});

const clientId = conf?.oauthClientId || process.env.DATABRICKS_OAUTH_CLIENT_ID;
const clientSecret = conf?.oauthClientSecret || process.env.DATABRICKS_OAUTH_CLIENT_SECRET;
if (clientId && !clientSecret) {
  throw new Error('DATABRICKS_OAUTH_CLIENT_SECRET must be set when OAuth client id is used');
}

const hasValidOAuthPair = (c) =>
  Boolean(c?.oauthClientId) === Boolean(c?.oauthClientSecret);

try {
  driver = new DatabricksDriver(conf);
} catch (e) {
  if (/No OAuth Client Secret provided/.test(e.message)) {
    throw new Error('Set DATABRICKS_OAUTH_CLIENT_SECRET in the deployment environment');
  }
  throw e;
}

When it happens

Trigger: new DatabricksDriver({...}) with oauthClientId set (or DATABRICKS_OAUTH_CLIENT_ID env) but oauthClientSecret missing (or DATABRICKS_OAUTH_CLIENT_SECRET unset), and no pwd/token fallback confusion — the pair is checked before password checks.

Common situations: Setting the client ID env var but forgetting the secret in the deployment environment; secrets not mounted in CI/K8s; partial copy-paste of OAuth config in cube.js datasourceOptions.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Invalid credentials: No OAuth Client ID provided
• No credentials provided
• Unsupported configuration exportBucket, some configuration k
• Warehouse is being deleted (current state: ${data.state})
• A user-defined contextToApiScopes function returns an incons

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/75d48f931a086d55. Report an issue: GitHub.