auth login writes workspace_id to account-level profile, breaking auth describe

[yamadahirotaka3tm]

Describe the issue

databricks auth login for an account-level profile auto-generates a workspace_id field in .databrickscfg. This causes databricks auth describe to fail with Unable to authenticate: Unable to load OAuth Config, even though databricks auth token works correctly with the same profile. Removing workspace_id from the profile resolves the issue.

Steps to reproduce the behavior

1. Run account-level login:

   databricks auth login --host https://accounts.cloud.databricks.com --account-id <account-id>

2. Follow the interactive prompts (select a workspace when asked).
3. Observe the auto-generated profile in ~/.databrickscfg:

   [ACCOUNT-<account-id>]
   host         = https://accounts.cloud.databricks.com/
   account_id   = <account-id>
   workspace_id = <workspace-id>
   auth_type    = databricks-cli

4. Run databricks auth token --profile ACCOUNT-<account-id> → succeeds (returns a valid token).
5. Run databricks auth describe --profile ACCOUNT-<account-id> → fails with Unable to authenticate: Unable to load OAuth Config.
6. Manually remove workspace_id from the profile and re-login.
7. Run databricks auth describe --profile ACCOUNT-<account-id> again → succeeds (Authenticated with: databricks-cli).

Expected Behavior

• auth describe should work with the auto-generated profile without manual edits.

Actual Behavior

• auth login writes workspace_id into the account-level profile.
• auth describe fails with Unable to authenticate: Unable to load OAuth Config.
• auth token succeeds with the same profile, indicating an inconsistency between the two commands.

OS and CLI version

• OS: Windows
• CLI: Databricks CLI v1.2.1

Is this a regression?

Unknown. This was observed on v1.2.1 (latest as of 2026-06-09). Not tested on earlier versions.

Debug Logs

> databricks auth describe --profile ACCOUNT-<account-id>
Unable to authenticate: Unable to load OAuth Config
Token storage: secure, OS keyring (service: databricks-cli) (from auth_storage in [__settings__] section of C:/Users/<user>/.databrickscfg)
-----
Current configuration:
  ✓ host: https://accounts.cloud.databricks.com/ (from C:\Users\<user>/.databrickscfg config file)
  ✓ account_id: <account-id> (from C:\Users\<user>/.databrickscfg config file)
  ✓ workspace_id: <workspace-id> (from C:\Users\<user>/.databrickscfg config file)
  ✓ profile: ACCOUNT-<account-id> (from --profile flag)
  ✓ auth_type: databricks-cli (from C:\Users\<user>/.databrickscfg config file)
  ✓ cloud: AWS
  ✓ audience: <account-id>
  ✓ discovery_url: https://accounts.cloud.databricks.com/oidc/accounts/<account-id>/.well-known/oauth-authorization-server

[simonfaltum]

Hi @yamadahirotaka3tm
Thanks for the report.
I have tried to reproduce it following your steps both on mac and windows 11.
In both cases, when after I login to my account through the browser, it asks me to enter a workspace Id and I press enter to skip.

My profile looks like this:

[ACCOUNT-<uuid>]
host       = https://accounts.cloud.databricks.com
account_id = <uuid>
auth_type  = databricks-cli

You wrote in your step-by-step
Follow the interactive prompts (select a workspace when asked).

I think one option is to skip a workspace, though I agree it might not be the most intuitive solution. We will look into improving this workflow.

[yamadahirotaka3tm]

@simonfaltum
Thanks for the response and for reproducing it.

Yes, I'm aware that skipping the workspace selection avoids the issue — I filed this primarily as a report, since the CLI's interactive prompt naturally encourages users to select a workspace, and doing so produces a profile that breaks auth describe.

I'm glad to hear you're looking into improving this workflow. Thanks again!