What causes "No credentials provided" in cube-js/cube?

Set DATABRICKS_TOKEN (or pass pwd/token option) for token auth

No credentials provided

Error message

No credentials provided

What it means

With no OAuth pair and no password/token, the driver has no usable authentication and throws 'No credentials provided' at construction time. This is the exhaust case of the driver's credential validation chain.

Source

Thrown at packages/cubejs-databricks-jdbc-driver/src/DatabricksDriver.ts:234

      getEnv('jdbcUrl', { dataSource, preAggregations });
    if (url.indexOf('jdbc:spark://') !== -1) {
      showSparkProtocolWarn = true;
      url = url.replace('jdbc:spark://', 'jdbc:databricks://');
    }

    const [uid, pwd, cleanedUrl] = extractAndRemoveUidPwdFromJdbcUrl(url);
    const passwd = conf?.token ||
          getEnv('databricksToken', { dataSource, preAggregations }) ||
          pwd;
    const oauthClientId = conf?.oauthClientId || getEnv('databricksOAuthClientId', { dataSource, preAggregations });
    const oauthClientSecret = conf?.oauthClientSecret || getEnv('databricksOAuthClientSecret', { dataSource, preAggregations });

    if (oauthClientId && !oauthClientSecret) {
      throw new Error('Invalid credentials: No OAuth Client Secret provided');
    } else if (!oauthClientId && oauthClientSecret) {
      throw new Error('Invalid credentials: No OAuth Client ID provided');
    } else if (!oauthClientId && !oauthClientSecret && !passwd) {
      throw new Error('No credentials provided');
    }

    let authProps: Record<string, any> = {};

    // OAuth has an advantage over UID+PWD
    // For magic numbers below - see Databricks docs:
    // https://docs.databricks.com/aws/en/integrations/jdbc-oss/configure#authenticate-the-driver
    if (oauthClientId) {
      authProps = {
        OAuth2ClientID: oauthClientId,
        OAuth2Secret: oauthClientSecret,
        AuthMech: 11,
        Auth_Flow: 1,
      };
    } else {
      authProps = {
        UID: uid,
        PWD: passwd,

View on GitHub (pinned to 7d981676b3)

Solutions

Set DATABRICKS_TOKEN (or pass pwd/token option) for token auth
Or configure the full OAuth pair: oauthClientId + oauthClientSecret (plus the required OAuth envs)
Verify env vars in the actual Cube process (print/inspect env at startup in a safe way)
Check getEnv dataSource scoping so credentials match the dataSource being used

Example fix

// before
new DatabricksDriver({ url }); // no credentials anywhere
// after
new DatabricksDriver({ url, pwd: process.env.DATABRICKS_TOKEN });
// or full OAuth
new DatabricksDriver({
  url,
  oauthClientId: process.env.DATABRICKS_OAUTH_CLIENT_ID,
  oauthClientSecret: process.env.DATABRICKS_OAUTH_CLIENT_SECRET,
});

Defensive patterns

Strategy: validation

Validate before calling

const hasCreds = Boolean(
  conf?.pwd || conf?.token || process.env.DATABRICKS_TOKEN ||
  ((conf?.oauthClientId || process.env.DATABRICKS_OAUTH_CLIENT_ID) &&
   (conf?.oauthClientSecret || process.env.DATABRICKS_OAUTH_CLIENT_SECRET))
);
if (!hasCreds) throw new Error('Databricks: set DATABRICKS_TOKEN or full OAuth pair before starting Cube');

Type guard

const hasAnyCredential = (c) =>
  Boolean(c?.pwd || c?.token || process.env.DATABRICKS_TOKEN ||
    ((c?.oauthClientId || process.env.DATABRICKS_OAUTH_CLIENT_ID) &&
     (c?.oauthClientSecret || process.env.DATABRICKS_OAUTH_CLIENT_SECRET)));

Try / catch

try {
  driver = new DatabricksDriver(conf);
} catch (e) {
  if (/No credentials provided/.test(e.message)) {
    throw new Error('Databricks driver requires DATABRICKS_TOKEN (pwd) or an OAuth client id/secret pair');
  }
  throw e;
}

Prevention

Set DATABRICKS_TOKEN in the environment Cube actually runs in (container/CI), not just your shell
Validate credential presence at app bootstrap before serving queries
Check env var names and per-dataSource scoping after migrations
Keep a startup health-check that constructs each driver once

When it happens

Trigger: new DatabricksDriver({...}) where conf has no oauthClientId/oauthClientSecret and password is empty: no pwd option, no databricksToken/databricksPassword env (for the relevant dataSource/preAggregations scope).

Common situations: Deploying without any Databricks env vars configured; env vars set under wrong names or wrong dataSource scope; secrets stripped in CI; migrating from local .env to production where envs were not carried over.

Related errors

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/b92055aad9a33080. Report an issue: GitHub.