mem0ai/mem0 · error · Error

Databricks vector store requires clientId/clientSecret for O

Error message

Databricks vector store requires clientId/clientSecret for OAuth token refresh.

What it means

getOAuthAccessToken() mints and refreshes OAuth tokens for service-principal auth. When the cached token has expired (or no token exists for the scope) it must call the token endpoint, which fundamentally requires clientId/clientSecret. If they are absent — e.g. the store was built with a custom httpClient and no service-principal credentials — refresh throws.

Source

Thrown at mem0-ts/src/oss/src/vector_stores/databricks.ts:974

        this.fullIndexName,
        "WriteVectorIndex",
      );
    }

    return undefined;
  }

  private async getOAuthAccessToken(
    authorizationDetails?: string,
  ): Promise<string> {
    const cacheKey = authorizationDetails || "__management__";
    const cached = this.oauthTokens.get(cacheKey);
    if (cached && Date.now() < cached.expiresAt - 60_000) {
      return cached.accessToken;
    }

    if (!this.clientId || !this.clientSecret) {
      throw new Error(
        "Databricks vector store requires clientId/clientSecret for OAuth token refresh.",
      );
    }

    const formData = new URLSearchParams({
      grant_type: "client_credentials",
      scope: "all-apis",
    });
    if (authorizationDetails) {
      formData.set("authorization_details", authorizationDetails);
    }

    const response = await axios.post(
      `${this.workspaceUrl}/oidc/v1/token`,
      formData,
      {
        auth: {
          username: this.clientId,

View on GitHub (pinned to 001c235229)

Solutions

1. Provide clientId and clientSecret in the config so token refresh can work
2. Or switch to a long-lived accessToken (PAT) if token rotation is not desired — though PATs expire too and must be rotated manually
3. Or supply your own httpClient that handles auth headers and refresh externally

Example fix

// before
new Databricks({ host, httpClient: myClient }); // no SP credentials

// after
new Databricks({ host, clientId: process.env.DBX_CLIENT_ID!, clientSecret: process.env.DBX_CLIENT_SECRET! });

if (usingOauth && !(cfg.clientId && cfg.clientSecret)) {
  throw new Error('Long-running OAuth usage requires clientId/clientSecret for refresh');
}

try { await store.search(q, 5); } catch (e) { if (e instanceof Error && e.message.includes('clientId/clientSecret for OAuth token refresh')) { /* switch to PAT or add SP credentials */ } throw e; }

When it happens

Trigger: Constructing the store with an httpClient or an initially valid token but no clientId/clientSecret, then running long enough for a cached token to expire (past expiresAt - 60s) so a refresh is attempted.

Common situations: Long-lived servers using OAuth initially but config later changed to PAT-only; injecting a mock httpClient in tests while production config lacks service-principal credentials; expired token cache after Databricks rotates keys.

Related errors

• Databricks vector store requires accessToken or clientId/cli
• Databricks OAuth token response did not include access_token
• Databricks vector store requires accessToken or clientId/cli
• Either access_token or both client_id/client_secret or azure
• Invalid ${label} '${name}': only letters, digits, and unders

AI-assisted analysis of mem0ai/mem0@001c235229 (2026-08-15). Data as JSON: /api/errors/452995d97e93f11d. Report an issue: GitHub.