OAuth Url and ClientId Validation

[Leo_310]

Hi

I am trying to setup an oauth connection with databricks, so I ask the user to enter their Workspace URL and ClientId.

Once the user enters these values, I want to validate whether they are correct or not, so I ask them to login by redirecting them to the authorize Url.

If Workspace URL is correct but clientId is incorrect, it gets stuck on this window showing client id is incorrect, but it does not return this error back to my Frontend. I tried doing via popup so as to not block my UI, but is there a way to get this error back to Parent window? Maybe add it to URL or something, as other OAuth providers do give some errors/expose endpoints to validate if client id is correct or not.

This way I will be able to tell users more clearly as to what the issue is.

Thanks

[Leo_310]

RFC for the reference https://datatracker.ietf.org/doc/html/rfc6749#section-4.1.2.1

[mark_ott]

If you’re using OAuth with Databricks and want to validate both the Workspace URL and ClientId before proceeding, you’re facing an issue seen by others: when the Workspace URL is correct but the ClientId is wrong, Databricks just displays a generic error (like “invalid client id”) in the popup window and does not pass this error back to your frontend or parent window directly. This makes it difficult to inform users about the exact problem with their credentials.​

Why the OAuth error isn’t returned to parent

Most OAuth flows (per RFC6749) redirect errors to the redirect_uri if one is provided and valid. However, with Databricks, if the ClientId is wrong, the authorization window typically just stops at the error screen without forwarding error information in a URL query string, nor does it send events or messages back to the frontend. This is different from some other OAuth providers that more actively use the redirect_uri to communicate error details.​

Common workarounds

• You can use a popup for the OAuth flow to avoid blocking your main UI, but since Databricks does not redirect on some errors, you won’t get callback information using standard mechanisms alone.​

• Some developers set up their own redirect page (hosted on the same domain as the parent app), which attempts to communicate with the opener via window.opener.postMessage(), or by adding error details to URL fragments (e.g., redirect_uri?error=invalid_client). This only works if Databricks redirects even on client errors, which may not be the case for an invalid ClientId with their flow.​

• Other providers do give detailed error codes on the redirect_uri, making it much easier to surface and diagnose client-side issues.​

Possible strategies for better error handling

• Double-check that the redirect_uri you register is correct and includes generous error handling code on your side; if Databricks does redirect even on error, you can parse error query params or hash fragments.​

• If the window gets “stuck” and does not redirect, consider polling the popup window for its URL or contents to detect if the error page has loaded, then close the popup and display your own error (although this is hacky and may not always be reliable).​

• Some integrations check the ClientId and Workspace URL by directly calling Databricks’ token endpoint before initiating a full login window; failed requests to this endpoint will return descriptive errors (401, 403, etc.) that you can surface immediately in your UI. This may help you catch errors before involving the user in an interactive OAuth flow.​

Summary Table

OAuth Provider	Error on Redirect URI	Error Propagated to Parent	Notes
Databricks	Sometimes, not always​	Rarely​	Often gets stuck on error page for clientId issues
Others	Usually​	Usually with error param	E.g., Google, Auth0, etc.

Recommendations

• Before sending users to OAuth, validate credentials using token endpoint (catch 401s).

• Use a custom redirect page to try to capture errors with window.opener.postMessage().

• Watch the popup window for navigation changes and close it if error pages are detected.

• Document the clientId validation pitfall for your end-users, so they know what to expect.

This approach should help you inform users more clearly about issues with their credentials and improve your overall UX.​