cube-js/cube · error · Error

options.checkSqlAuth must be a function

Error message

options.checkSqlAuth must be a function

What it means

registerInterface requires a checkSqlAuth function that authenticates SQL API connections (user/password for the Postgres-style SQL endpoint). Without it, SQL sessions cannot be authorized, so the options are rejected.

Source

Thrown at packages/cubejs-backend-native/js/index.ts:396

};

export type SqlInterfaceInstance = { __typename: 'sqlinterfaceinstance' };

export const registerInterface = async (options: SQLInterfaceOptions): Promise<SqlInterfaceInstance> => {
  if (typeof options !== 'object' && options == null) {
    throw new Error('Argument options must be an object');
  }

  if (typeof options.contextToApiScopes !== 'function') {
    throw new Error('options.contextToApiScopes must be a function');
  }

  if (typeof options.checkAuth !== 'function') {
    throw new Error('options.checkAuth must be a function');
  }

  if (typeof options.checkSqlAuth !== 'function') {
    throw new Error('options.checkSqlAuth must be a function');
  }

  if (typeof options.meta !== 'function') {
    throw new Error('options.meta must be a function');
  }

  if (typeof options.stream !== 'function') {
    throw new Error('options.stream must be a function');
  }

  if (typeof options.sqlApiLoad !== 'function') {
    throw new Error('options.sqlApiLoad must be a function');
  }

  if (typeof options.sqlGenerators !== 'function') {
    throw new Error('options.sqlGenerators must be a function');
  }

View on GitHub (pinned to 7d981676b3)

Solutions

1. Add checkSqlAuth, e.g. async (username, password) => ({ password }), resolving the user's security context.
2. Wire it to the same JWT verification your checkAuth uses, returning the expected password for the SQL client.
3. Confirm no conditional branches assign checkSqlAuth only sometimes.

Example fix

// before
await registerInterface({ contextToApiScopes, checkAuth, meta, stream });

// after
await registerInterface({
  contextToApiScopes, checkAuth,
  checkSqlAuth: async (user, password) => ({ password }),
  meta, stream
});

if (typeof options.checkSqlAuth !== 'function') {
  throw new Error('options.checkSqlAuth must be provided as a function');
}

function hasCheckSqlAuth(o) {
  return typeof o?.checkSqlAuth === 'function';
}

try {
  await registerInterface(options);
} catch (e) {
  if (e.message === 'options.checkSqlAuth must be a function') {
    console.error('Provide checkSqlAuth: async (user, password) => ({ password }).');
  } else throw e;
}

When it happens

Trigger: Calling registerInterface() with an options object whose checkSqlAuth property is missing or not a function.

Common situations: Setting up the SQL API through the native planner but only configuring REST-side auth; copying example code predating the checkSqlAuth requirement; typo like checkSqlAuth vs checkSqlAuth.

Related errors

• options.contextToApiScopes must be a function
• options.checkAuth must be a function
• options.meta must be a function
• options.stream must be a function
• Argument options must be an object

AI-assisted analysis of cube-js/cube@7d981676b3 (2026-09-02). Data as JSON: /api/errors/fd78cd4602d17181. Report an issue: GitHub.