{"id":"9358ed5968f35ca8","repo":"mongodb/node-mongodb-native","slug":"authcontext-must-provide-credentials-9358ed","errorCode":null,"errorMessage":"AuthContext must provide credentials.","messagePattern":"AuthContext must provide credentials\\.","errorType":"exception","errorClass":"MongoMissingCredentialsError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongodb_oidc.ts","lineNumber":182,"sourceCode":"   */\n  override async prepare(\n    handshakeDoc: HandshakeDocument,\n    authContext: AuthContext\n  ): Promise<HandshakeDocument> {\n    const { connection } = authContext;\n    const credentials = getCredentials(authContext);\n    const result = await this.workflow.speculativeAuth(connection, credentials);\n    return { ...handshakeDoc, ...result };\n  }\n}\n\n/**\n * Get credentials from the auth context, throwing if they do not exist.\n */\nfunction getCredentials(authContext: AuthContext): MongoCredentials {\n  const { credentials } = authContext;\n  if (!credentials) {\n    throw new MongoMissingCredentialsError(MISSING_CREDENTIALS_ERROR);\n  }\n  return credentials;\n}\n","sourceCodeStart":164,"sourceCodeEnd":186,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongodb_oidc.ts#L164-L186","documentation":"Thrown by the OIDC auth provider's getCredentials() helper when the AuthContext has no credentials object (src/cmap/auth/mongodb_oidc.ts:181). MONGODB-OIDC requires at least the mechanism (and for some environments a username or ENVIRONMENT/TOKEN_RESOURCE) to be configured. Surfaced as a MongoMissingCredentialsError.","triggerScenarios":"Connecting with authMechanism=MONGODB-OIDC but without any credentials materializing in the AuthContext - e.g. omitting the mechanism properties entirely, or a credential merge step that produced no credentials object. Also triggered when ENVIRONMENT is not one of the recognized values so no workflow is selected and credentials end up empty.","commonSituations":"Specifying authMechanism=MONGODB-OIDC with no authMechanismProperties at all, misspelling ENVIRONMENT (e.g. ENV:azure), or expecting callback-based OIDC without registering the callback.","solutions":["Provide authMechanismProperties including ENVIRONMENT (e.g. ENVIRONMENT:azure,TOKEN_RESOURCE:...) or a valid OIDC callback.","For username/password-style OIDC (multi-tenant), set the username as appropriate for your IdP.","Verify the connection string includes authMechanism=MONGODB-OIDC and that authSource is $external.","Confirm you are on a driver version that supports MONGODB-OIDC."],"exampleFix":"// before\nconst c = new MongoClient('mongodb://host/?authMechanism=MONGODB-OIDC');\n\n// after\nconst c = new MongoClient(\n  'mongodb://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:azure,TOKEN_RESOURCE:https://cluster.example.com'\n);","handlingStrategy":"validation","validationCode":"function validateOidcCredentials(uri: string): void {\n  if (!/authMechanism=MONGODB-OIDC/i.test(uri)) return;\n  const hasEnvOrCallback = /ENVIRONMENT=/i.test(uri) || /OIDC_CALLBACK=/i.test(uri);\n  if (!hasEnvOrCallback) {\n    throw new Error('MONGODB-OIDC requires ENVIRONMENT or a callback in authMechanismProperties');\n  }\n}\nvalidateOidcCredentials(connectionString);","typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoMissingCredentialsError && /AuthContext must provide credentials/.test(e.message) && mechanism === 'MONGODB-OIDC') {\n    throw new Error('OIDC auth needs ENVIRONMENT (and TOKEN_RESOURCE) or a callback configured.');\n  }\n  throw e;\n}","preventionTips":["Provide ENVIRONMENT (plus TOKEN_RESOURCE for azure/gcp) or a registered callback whenever using MONGODB-OIDC.","Validate connection-string auth properties at config-load time.","Use authSource=$external for OIDC."],"tags":["auth","oidc","credentials","configuration","validation"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}