{"id":"1348ba06f024c019","repo":"mongodb/node-mongodb-native","slug":"token-resource-must-be-set-in-the-auth-mechanism-p-1348ba","errorCode":null,"errorMessage":"TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is gcp.","messagePattern":"TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is gcp\\.","errorType":"exception","errorClass":"MongoGCPError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongodb_oidc/gcp_machine_workflow.ts","lineNumber":26,"sourceCode":"\n/** GCP request headers. */\nconst GCP_HEADERS = Object.freeze({ 'Metadata-Flavor': 'Google' });\n\n/** Error for when the token audience is missing in the environment. */\nconst TOKEN_RESOURCE_MISSING_ERROR =\n  'TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is gcp.';\n\n/**\n * The callback function to be used in the automated callback workflow.\n * @param params - The OIDC callback parameters.\n * @returns The OIDC response.\n */\nexport const gcpCallback: OIDCCallbackFunction = async (\n  params: OIDCCallbackParams\n): Promise<OIDCResponse> => {\n  const tokenAudience = params.tokenAudience;\n  if (!tokenAudience) {\n    throw new MongoGCPError(TOKEN_RESOURCE_MISSING_ERROR);\n  }\n  return await getGcpTokenData(tokenAudience);\n};\n\n/**\n * Hit the GCP endpoint to get the token data.\n */\nasync function getGcpTokenData(tokenAudience: string): Promise<OIDCResponse> {\n  const url = new URL(GCP_BASE_URL);\n  url.searchParams.append('audience', tokenAudience);\n  const response = await get(url, {\n    headers: GCP_HEADERS\n  });\n  if (response.status !== 200) {\n    throw new MongoGCPError(\n      `Status code ${response.status} returned from the GCP endpoint. Response body: ${response.body}`\n    );\n  }","sourceCodeStart":8,"sourceCodeEnd":44,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongodb_oidc/gcp_machine_workflow.ts#L8-L44","documentation":"Thrown by the GCP machine OIDC workflow when ENVIRONMENT is set to 'gcp' but TOKEN_RESOURCE is missing (src/cmap/auth/mongodb_oidc/gcp_machine_workflow.ts:25). TOKEN_RESOURCE becomes the 'audience' query parameter passed to the GCP metadata service token endpoint and is required. Surfaced as a MongoGCPError.","triggerScenarios":"Connecting with MONGODB-OIDC and authMechanismProperties=ENVIRONMENT:gcp but omitting TOKEN_RESOURCE. The gcpCallback checks params.tokenAudience and throws before contacting the GCP metadata endpoint.","commonSituations":"Missing or misspelled TOKEN_RESOURCE in the connection string, copy-paste from GCP docs that used a different property name, or assuming the GCP metadata service does not need an audience.","solutions":["Add TOKEN_RESOURCE to authMechanismProperties, e.g. ENVIRONMENT:gcp,TOKEN_RESOURCE:<mongodb-cluster-audience>.","Confirm the TOKEN_RESOURCE matches the audience configured on the MongoDB server for OIDC.","Use exact property casing and comma-separate multiple properties in the connection string."],"exampleFix":"// before\nconst c = new MongoClient('mongodb://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:gcp');\n\n// after\nconst c = new MongoClient(\n  'mongodb://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:gcp,TOKEN_RESOURCE:https://cluster.example.com'\n);","handlingStrategy":"validation","validationCode":"function validateGcpOidcProps(props: Record<string, unknown>): void {\n  if (props.ENVIRONMENT === 'gcp' && !props.TOKEN_RESOURCE) {\n    throw new Error('TOKEN_RESOURCE is required when ENVIRONMENT=gcp');\n  }\n}\nvalidateGcpOidcProps(parsedMechanismProperties);","typeGuard":"function isGcpOidcConfig(props: unknown): props is { ENVIRONMENT: 'gcp'; TOKEN_RESOURCE: string } {\n  return !!props && typeof props === 'object'\n    && (props as any).ENVIRONMENT === 'gcp'\n    && typeof (props as any).TOKEN_RESOURCE === 'string';\n}","tryCatchPattern":null,"preventionTips":["Derive authMechanismProperties from a typed config so missing TOKEN_RESOURCE is a compile-time miss.","Document the required TOKEN_RESOURCE for GCP deployments.","Add a startup assertion for the mechanism properties shape."],"tags":["auth","oidc","gcp","configuration","validation"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}