{"record":{"id":"b8def113d53ce7d4","repo":"mongodb/node-mongodb-native","slug":"oidc-token-file-must-be-set-in-the-environment","errorCode":null,"errorMessage":"OIDC_TOKEN_FILE must be set in the environment.","messagePattern":"OIDC_TOKEN_FILE must be set in the environment\\.","errorType":"exception","errorClass":"MongoAWSError","httpStatus":null,"severity":"critical","filePath":"src/cmap/auth/mongodb_oidc/token_machine_workflow.ts","lineNumber":18,"sourceCode":"import * as fs from 'fs';\nimport * as process from 'process';\n\nimport { MongoAWSError } from '../../../error';\nimport type { OIDCCallbackFunction, OIDCResponse } from '../mongodb_oidc';\n\n/** Error for when the token is missing in the environment. */\nconst TOKEN_MISSING_ERROR = 'OIDC_TOKEN_FILE must be set in the environment.';\n\n/**\n * The callback function to be used in the automated callback workflow.\n * @param params - The OIDC callback parameters.\n * @returns The OIDC response.\n */\nexport const tokenMachineCallback: OIDCCallbackFunction = async (): Promise<OIDCResponse> => {\n  const tokenFile = process.env.OIDC_TOKEN_FILE;\n  if (!tokenFile) {\n    throw new MongoAWSError(TOKEN_MISSING_ERROR);\n  }\n  const token = await fs.promises.readFile(tokenFile, 'utf8');\n  return { accessToken: token };\n};\n","sourceCodeStart":1,"sourceCodeEnd":23,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/dce7939f86fb283e167ad709955abedb7bf23124/src/cmap/auth/mongodb_oidc/token_machine_workflow.ts#L1-L23","documentation":"Thrown by the OIDC test machine workflow (token_machine_workflow.ts:18) when the OIDC_TOKEN_FILE environment variable is unset. This workflow reads a raw OIDC access token from the file at process.env.OIDC_TOKEN_FILE and is registered for ENVIRONMENT=test (mongodb_oidc.ts:124). It is intended for driver testing, not production authentication. Raised as MongoAWSError.","triggerScenarios":"Connecting with authMechanism='MONGODB-OIDC' and authMechanismProperties.ENVIRONMENT='test' (which selects tokenMachineCallback) while the OIDC_TOKEN_FILE environment variable is not exported, or is set to an empty string.","commonSituations":"Running OIDC test suites locally without exporting OIDC_TOKEN_FILE. A CI job that uses the test workflow but forgets to inject the env var. Accidentally using ENVIRONMENT=test in a non-test deployment expecting it to read another token source.","solutions":["Export OIDC_TOKEN_FILE pointing to a readable file containing the OIDC access token: export OIDC_TOKEN_FILE=/var/run/secrets/token","Ensure the file exists, is readable by the process, and contains a single valid token string","For production, use a supported cloud environment (gcp/azure/k8s) or supply your own callback instead of ENVIRONMENT=test"],"exampleFix":"# before\nURI='mongodb://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:test'\nnode app.js   # OIDC_TOKEN_FILE not set -> MongoAWSError\n\n# after\nexport OIDC_TOKEN_FILE=/var/run/secrets/mongodb-oidc/token\nURI='mongodb://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:test'\nnode app.js","handlingStrategy":"validation","validationCode":"if (process.env.OIDC_TOKEN_FILE === undefined || process.env.OIDC_TOKEN_FILE === '') {\n  throw new Error('OIDC_TOKEN_FILE env var must be set for ENVIRONMENT=test OIDC auth');\n}","typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (err) {\n  if (err instanceof MongoAWSError && /OIDC_TOKEN_FILE/.test(err.message)) {\n    process.env.OIDC_TOKEN_FILE = '/var/run/secrets/mongodb-oidc/token';\n    await client.connect();\n  } else throw err;\n}","preventionTips":["Validate required env vars at process startup before constructing MongoClient","Keep ENVIRONMENT=test for tests only; use a real environment or callback in production","Document OIDC_TOKEN_FILE in your deployment runbook"],"tags":["oidc","environment","configuration","test","authentication"],"backgroundTag":null,"analyzedSha":"dce7939f86fb283e167ad709955abedb7bf23124","analyzedAt":"2026-08-11T04:54:53.215Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}