mem0ai/mem0 · error · ValueError

Either access_token or both client_id/client_secret or azure

Error message

Either access_token or both client_id/client_secret or azure_client_id/azure_client_secret must be provided

What it means

Raised by DatabricksConfig.validate_authentication (mode='after', so it runs after field coercion) when no usable credential is present. Accepted: an access_token, or client_id+client_secret pair, or azure_client_id+azure_client_secret pair. With none of these, the config cannot authenticate to Databricks.

Source

Thrown at mem0/configs/vector_stores/databricks.py:55

        allowed_fields = set(cls.model_fields.keys())
        input_fields = set(values.keys())
        extra_fields = input_fields - allowed_fields
        if extra_fields:
            raise ValueError(
                f"Extra fields not allowed: {', '.join(extra_fields)}. Please input only the following fields: {', '.join(allowed_fields)}"
            )
        return values

    @model_validator(mode="after")
    def validate_authentication(self):
        """Validate that either access_token or service principal credentials are provided."""
        has_token = self.access_token is not None
        has_service_principal = (self.client_id is not None and self.client_secret is not None) or (
            self.azure_client_id is not None and self.azure_client_secret is not None
        )

        if not has_token and not has_service_principal:
            raise ValueError(
                "Either access_token or both client_id/client_secret or azure_client_id/azure_client_secret must be provided"
            )

        return self

    model_config = ConfigDict(arbitrary_types_allowed=True)

View on GitHub (pinned to 001c235229)

Solutions

1. Set 'access_token' to a Databricks personal access token or PAT-equivalent
2. Or set both 'client_id' and 'client_secret' for a Databricks service principal (OAuth M2M)
3. Or set both 'azure_client_id' and 'azure_client_secret' for an Azure service principal
4. Assert credentials resolve from your secret store before building the config; env vars are not read automatically

Example fix

# before
DatabricksConfig(host="https://adb-...", warehouse_name="wh")

# after
DatabricksConfig(host="https://adb-...", warehouse_name="wh", access_token=os.environ["DATABRICKS_TOKEN"])

def validate_databricks_auth(cfg: dict) -> None:
    token = cfg.get("access_token") is not None
    sp = (cfg.get("client_id") and cfg.get("client_secret")) or (
        cfg.get("azure_client_id") and cfg.get("azure_client_secret")
    )
    if not token and not sp:
        raise RuntimeError("Databricks config needs access_token or a full SP credential pair")

def databricks_auth_ok(cfg: dict) -> bool:
    return cfg.get("access_token") is not None or bool(
        (cfg.get("client_id") and cfg.get("client_secret"))
        or (cfg.get("azure_client_id") and cfg.get("azure_client_secret"))
    )

from pydantic import ValidationError
try:
    DatabricksConfig(**cfg)
except ValidationError as e:
    if "access_token" in str(e) and "client_id" in str(e):
        # fetch token/SP pair from secret store, then retry
        ...

When it happens

Trigger: Creating DatabricksConfig with host/warehouse fields but no credentials at all; providing client_id without client_secret (partial pair counts as no service principal); providing only Azure SP id without its secret. Because the validator is mode='after', None defaults survive to this check and fail here.

Common situations: Expecting Databricks CLI profile or DATABRICKS_TOKEN env var pickup (neither is read); token stored in a secret manager that returned None; SP rotation leaving one half of the pair unset in config.

Related errors

• Either 'password' must be provided or 'use_azure_credential'
• Both 'username' and 'password' must be provided together for
• Extra fields not allowed: {', '.join(extra_fields)}. Please
• Either api_key or user/password must be provided
• Databricks vector store requires either workspaceUrl or host

AI-assisted analysis of mem0ai/mem0@001c235229 (2026-08-15). Data as JSON: /api/errors/fed1f9116afdc0c3. Report an issue: GitHub.