{"record":{"id":"882c57d6f6f245af","repo":"transloadit/uppy","slug":"endpoint-is-required-for-credential-based-signing","errorCode":null,"errorMessage":"Endpoint is required for credential-based signing","messagePattern":"Endpoint is required for credential-based signing","errorType":"exception","errorClass":"Error","httpStatus":null,"severity":"critical","filePath":"packages/@uppy/aws-s3/src/s3-client/S3mini.ts","lineNumber":98,"sourceCode":"      this.signRequest = this._createCredentialBasedSigner()\n    } else {\n      throw new TypeError(\n        'Either signRequest or getCredentials must be provided',\n      )\n    }\n\n    this.region = region\n    this.requestSizeInBytes = requestSizeInBytes\n  }\n\n  /** Creates a presigner that fetches/caches credentials and generates pre-signed URLs. */\n  private _createCredentialBasedSigner(): IT.SignRequestFn {\n    return async (\n      request: IT.PresignableRequest,\n    ): Promise<IT.PresignedResponse> => {\n      const creds = await this._getCachedCredentials()\n      if (this.endpoint == null) {\n        throw new Error('Endpoint is required for credential-based signing')\n      }\n      const presigner = createSigV4Signer({\n        accessKeyId: creds.credentials.accessKeyId,\n        secretAccessKey: creds.credentials.secretAccessKey,\n        sessionToken: creds.credentials.sessionToken,\n        region: creds.region || this.region,\n        endpoint: this.endpoint.toString(),\n      })\n      return presigner(request)\n    }\n  }\n\n  /** Gets cached credentials or fetches new ones. */\n  private async _getCachedCredentials(): Promise<IT.CredentialsResponse> {\n    // Return Cached Credentials if available\n    if (this.cachedCredentials != null) {\n      return this.cachedCredentials\n    }","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/transloadit/uppy/blob/5d4dedd02a1ac0ae022c75c54aca76558f88e256/packages/@uppy/aws-s3/src/s3-client/S3mini.ts#L80-L116","documentation":"Thrown by s3mini's credential-based signer when no endpoint is configured. Signature Version 4 signing requires a known HTTP endpoint to build the canonical request (host header, path), so presigning with static credentials (accessKeyId/secretAccessKey) without an endpoint URL is impossible. The check runs eagerly in the constructor so the client fails fast instead of at first request.","triggerScenarios":"Constructing `new S3mini({ accessKeyId, secretAccessKey, ... })` (or otherwise enabling credential-based signing, e.g. additionalSigners) without an `endpoint` option; endpoint is null/undefined/empty at signing time.","commonSituations":"Migrating from a version where endpoint was optional or defaulted (e.g. derived from bucket/region); passing only `region` + credentials expecting an AWS URL to be synthesized; typos like `endPoint` or `host`; using a custom S3-compatible backend but forgetting its URL.","solutions":["Pass a valid `endpoint` URL when constructing S3mini with credentials: `new S3mini({ endpoint: 'https://s3.us-east-1.amazonaws.com', accessKeyId, secretAccessKey, region })`.","If you meant path-style addressing, include the bucket in the endpoint (e.g. `https://s3.region.amazonaws.com/my-bucket`) or set the bucket option per your client's config.","Check for misspelled option keys (`endPoint`, `baseUrl`) that silently leave `endpoint` undefined.","If you want ambient/default credentials instead of static ones, configure the client so the credential-based signer isn't selected."],"exampleFix":"// before\nconst s3 = new S3mini({ accessKeyId, secretAccessKey, region: 'us-east-1' })\n// after\nconst s3 = new S3mini({\n  endpoint: 'https://s3.us-east-1.amazonaws.com',\n  accessKeyId,\n  secretAccessKey,\n  region: 'us-east-1',\n})","handlingStrategy":"validation","validationCode":"const cfg = { endpoint: process.env.S3_ENDPOINT, accessKeyId, secretAccessKey }\nif (!cfg.endpoint || !/^https?:\\/\\//.test(cfg.endpoint)) {\n  throw new Error('S3 endpoint must be set to a http(s) URL when using static credentials')\n}\nconst s3 = new S3mini(cfg)","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate required config (endpoint + credentials) at app startup, not at first upload.","Centralize S3mini construction in one factory so endpoint checks happen in one place.","Add a smoke-test/health check that instantiates the client during deployment."],"tags":["aws-s3","credentials","sigv4","endpoint","configuration"],"backgroundTag":"missing-required-configuration","analyzedSha":"5d4dedd02a1ac0ae022c75c54aca76558f88e256","analyzedAt":"2026-08-28T12:18:41.267Z","schemaVersion":2},"datasetVersion":"2026-08-28T16:17:29.566Z"}