OBO auth implementation in Streamlit not working

rcatelli · ‎12-04-2025

Hello,

I am currently trying to implement OBO auth in a streamlit db app but I'm getting the following error message:

requests.exceptions.HTTPError: 400 Client Error: PERMISSION_DENIED: User does not have USE CATALOG on Catalog '...'. Config: host=, auth_type=model-serving, retry_timeout_seconds=500. Env: DATABRICKS_HOST for url: ...

I know I have access to the catalog it's saying I don't because I belong to a group that has access to it and besides I was able to execute in a notebook the USE CATALOG 'x' code successfully. So my belief is that I'm missing something to do OBO right.

This app queries an endpoint. Both have been granted permissions to access each other.

I have already added scopes in the app, as well as auth policy with user and system policy included, and the resources the model needs to access to.

Also when I try to pass

# --- Query the Databricks endpoint ---

with st.chat_message("assistant"):

response = query_endpoint(

endpoint_name=SERVING_ENDPOINT,

messages=st.session_state.messages,

max_tokens=600

#headers=forward_headers # Pass the user's token for OBO

)

It says that headers is not a valid parameter.

Could you please help? The documentation is not that complete either so I don't know what I could be missing.

#OBO #OBOauth #streamlitapp