What causes "Incorrect user name "${user}" or password" in cube-js/cube?

Set the SQL client username to the configured sqlUser (or sqlSuperUser) value, e.g. CUBEJS_SQL_USER.

Incorrect user name "${user}" or password

Error message

Incorrect user name "${user}" or password

What it means

When no custom checkSqlAuth is provided, SQLServer builds a default auth function that accepts a single fixed user/password from options (sqlUser/sqlPassword or sqlSuperUser). If the SQL client authenticates with a username different from the allowed one, the default function throws 'Incorrect user name "<user>" or password'. It is the Postgres/SQL-API analogue of a failed login.

Source

Thrown at packages/cubejs-api-gateway/src/sql-server.ts:365

        allowedUser = 'cube';

        displayCLIWarning(
          'Option sqlUser is required in production mode. Cube.js will use \'cube\' as a default username.'
        );
      }

      if (!allowedPassword) {
        allowedPassword = crypto.randomBytes(16).toString('hex');

        displayCLIWarning(
          `Option sqlPassword is required in production mode. Cube.js has generated it as '${allowedPassword}'`
        );
      }
    }

    return async (req, user) => {
      if (allowedUser && user !== allowedUser) {
        throw new Error(`Incorrect user name "${user}" or password`);
      }

      return {
        password: allowedPassword,
        securityContext: {},
        skipPasswordCheck: getEnv('devMode') && !allowedPassword
      };
    };
  }

  protected async contextByNativeReq(req: NativeRequest<LoadRequestMeta>, securityContext, requestId: string): Promise<ExtendedRequestContext> {
    const context = await this.apiGateway.contextByReq(<any> req, securityContext, requestId);

    return {
      ...context,
      ...req.meta,
    };
  }

View on GitHub (pinned to 7d981676b3)

Solutions

Set the SQL client username to the configured sqlUser (or sqlSuperUser) value, e.g. CUBEJS_SQL_USER.
Verify the password matches CUBEJS_SQL_PASSWORD / options.sqlPassword for that user.
Provide a custom checkSqlAuth function if dynamic per-user credentials or JWT-based SQL auth is required.

Example fix

// before
psql -h localhost -p 15432 -U postgres -d cube
// after (CUBEJS_SQL_USER=cube)
psql -h localhost -p 15432 -U cube -d cube

Defensive patterns

Strategy: validation

Validate before calling

const expectedUser = process.env.CUBEJS_SQL_USER; // or options.sqlUser
if (sqlClientUser !== expectedUser) {
  throw new Error(`SQL client user must be "${expectedUser}", got "${sqlClientUser}"`);
}

Type guard

null

Try / catch

try {
  await connectToCubeSql({ user: CUBEJS_SQL_USER, password: CUBEJS_SQL_PASSWORD });
} catch (e) {
  if (e.message.includes('Incorrect user name')) {
    console.error(`Wrong SQL credentials: ${e.message}; check CUBEJS_SQL_USER/CUBEJS_SQL_PASSWORD`);
  } else throw e;
}

Prevention

Store CUBEJS_SQL_USER and CUBEJS_SQL_PASSWORD in env and use them verbatim in clients.
Never reuse database (Postgres) credentials for the Cube SQL API.
Rotate credentials simultaneously in server config and all BI tool connections.
Implement custom checkSqlAuth if you need dynamic users/JWT-based SQL auth.

When it happens

Trigger: Connecting to Cube's SQL API with a username other than the configured sqlUser (or sqlSuperUser when connecting on the superuser port), e.g. typing 'postgres' or an OS username into the SQL client's user field.

Common situations: BI tools defaulting the username to the OS user or 'postgres'; reusing database credentials instead of the Cube SQL credentials; after rotating sqlPassword/sqlUser in options or env without updating clients; connecting with a JWT-expected flow while the default static auth is configured.

Related errors

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/2345fd376e60d92a. Report an issue: GitHub.