cube-js/cube · error

Both user/password and auth token are set. Please remove pas

Error message

Both user/password and auth token are set. Please remove password or token.

What it means

PrestoDriver supports either basic auth (user/password) or token auth, not both. At construction time it reads dbPass and prestoAuthToken env/config; if both are set it throws to avoid ambiguous credentials being sent to Presto.

Source

Thrown at packages/cubejs-prestodb-driver/src/PrestoDriver.ts:101

  protected useSelectTestConnection: boolean;

  /**
   * Class constructor.
   */
  public constructor(config: PrestoDriverConfiguration = {}) {
    super();

    const dataSource =
      config.dataSource ||
      assertDataSource('default');
    const preAggregations = config.preAggregations || false;

    const dbUser = getEnv('dbUser', { dataSource, preAggregations });
    const dbPassword = getEnv('dbPass', { dataSource, preAggregations });
    const authToken = getEnv('prestoAuthToken', { dataSource, preAggregations });

    if (authToken && dbPassword) {
      throw new Error('Both user/password and auth token are set. Please remove password or token.');
    }

    this.useSelectTestConnection = config.useSelectTestConnection ??
      getEnv('dbUseSelectTestConnection', { dataSource, preAggregations });

    this.config = {
      host: getEnv('dbHost', { dataSource, preAggregations }),
      port: getEnv('dbPort', { dataSource, preAggregations }),
      catalog:
        getEnv('prestoCatalog', { dataSource, preAggregations }) ||
        getEnv('dbCatalog', { dataSource, preAggregations }),
      schema:
        getEnv('dbName', { dataSource, preAggregations }) ||
        getEnv('dbSchema', { dataSource, preAggregations }),
      user: dbUser,
      ...(authToken ? { custom_auth: `Bearer ${authToken}` } : {}),
      ...(dbPassword ? { basic_auth: { user: dbUser, password: dbPassword } } : {}),
      ssl: this.getSslOptions(dataSource, preAggregations),

View on GitHub (pinned to 7d981676b3)

Solutions

1. Remove the password (CUBEJS_DB_PASS / config.password) and keep only the auth token
2. Or remove the auth token (CUBEJS_PRESTO_AUTH_TOKEN / config.authToken) if you intend user/password auth
3. Audit .env / deployment secrets so only one auth mechanism is configured

Example fix

// before (.env)
CUBEJS_DB_PASS=secret
CUBEJS_PRESTO_AUTH_TOKEN=eyJhbGci...
// after (.env)
CUBEJS_PRESTO_AUTH_TOKEN=eyJhbGci...

if (process.env.CUBEJS_DB_PASS && process.env.CUBEJS_PRESTO_AUTH_TOKEN) {
  throw new Error('Remove either CUBEJS_DB_PASS or CUBEJS_PRESTO_AUTH_TOKEN before starting');
}

const hasExactlyOneAuth = (cfg) => (!!cfg.password !== !!cfg.authToken);

try {
  const driver = new PrestoDriver(config);
} catch (e) {
  if (String(e.message).includes('Both user/password and auth token')) {
    delete config.password; // prefer token auth
  }
  throw e;
}

When it happens

Trigger: Instantiating PrestoDriver (or letting Cube build it from env) when CUBEJS_DB_PASS and CUBEJS_PRESTO_AUTH_TOKEN (or config.password + config.authToken) are both present.

Common situations: Leftover password env vars after switching to token-based auth; CI environments with both credentials in .env; team config templates containing both auth styles.

Related errors

• Auth isn't set
• Auth isn't set
• Export bucket is not configured.
• Unsupported export bucket type: ${this.config.bucketType}
• Unable to decode JWT key

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/b19463b73057073e. Report an issue: GitHub.