{"id":"b8def113d53ce7d4","repo":"mongodb/node-mongodb-native","slug":"oidc-token-file-must-be-set-in-the-environment","errorCode":null,"errorMessage":"OIDC_TOKEN_FILE must be set in the environment.","messagePattern":"OIDC_TOKEN_FILE must be set in the environment\\.","errorType":"exception","errorClass":"MongoAWSError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongodb_oidc/token_machine_workflow.ts","lineNumber":18,"sourceCode":"import * as fs from 'fs';\nimport * as process from 'process';\n\nimport { MongoAWSError } from '../../../error';\nimport type { OIDCCallbackFunction, OIDCResponse } from '../mongodb_oidc';\n\n/** Error for when the token is missing in the environment. */\nconst TOKEN_MISSING_ERROR = 'OIDC_TOKEN_FILE must be set in the environment.';\n\n/**\n * The callback function to be used in the automated callback workflow.\n * @param params - The OIDC callback parameters.\n * @returns The OIDC response.\n */\nexport const tokenMachineCallback: OIDCCallbackFunction = async (): Promise<OIDCResponse> => {\n  const tokenFile = process.env.OIDC_TOKEN_FILE;\n  if (!tokenFile) {\n    throw new MongoAWSError(TOKEN_MISSING_ERROR);\n  }\n  const token = await fs.promises.readFile(tokenFile, 'utf8');\n  return { accessToken: token };\n};\n","sourceCodeStart":1,"sourceCodeEnd":23,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongodb_oidc/token_machine_workflow.ts#L1-L23","documentation":"Thrown by the token machine OIDC workflow when the OIDC_TOKEN_FILE environment variable is not set (src/cmap/auth/mongodb_oidc/token_machine_workflow.ts:17). This workflow (registered as the 'test' environment) reads the access token from a file path pointed to by OIDC_TOKEN_FILE. Surfaced as a MongoAWSError.","triggerScenarios":"Connecting with MONGODB-OIDC and authMechanismProperties=ENVIRONMENT:test without the OIDC_TOKEN_FILE environment variable defined. The workflow reads process.env.OIDC_TOKEN_FILE and throws before any file read.","commonSituations":"Using the 'test' OIDC environment (commonly for driver spec tests or spire/spire-style workload identity where a sidecar writes a token file) but forgetting to set OIDC_TOKEN_FILE in the process environment, or setting it in a different shell than the one running the driver.","solutions":["Set the OIDC_TOKEN_FILE environment variable to the absolute path of the file containing the OIDC access token.","Ensure the variable is exported in the same process/shell that runs the Node application.","If running in containers, pass the env var and mount the token file into the container.","If you did not intend the test environment, remove ENVIRONMENT:test and use azure/gcp/k8s or a callback workflow instead."],"exampleFix":"# before\nexport OIDC_ENV=test\nnode app.js   # OIDC_TOKEN_FILE unset -> error\n\n# after\nexport OIDC_TOKEN_FILE=/var/run/secrets/tokens/mongodb-oidc-token\nnode app.js","handlingStrategy":"validation","validationCode":"function assertOidcTokenFileEnv(): void {\n  if (process.env.OIDC_TOKEN_FILE == null || process.env.OIDC_TOKEN_FILE === '') {\n    throw new Error('OIDC_TOKEN_FILE must be set in the environment when using ENVIRONMENT=test');\n  }\n}\nassertOidcTokenFileEnv();","typeGuard":null,"tryCatchPattern":"try {\n  await client.connect();\n} catch (e) {\n  if (e instanceof MongoAWSError && /OIDC_TOKEN_FILE/.test(e.message)) {\n    throw new Error('Set OIDC_TOKEN_FILE to the path of the file containing the OIDC token.');\n  }\n  throw e;\n}","preventionTips":["Set OIDC_TOKEN_FILE in the process environment (and container spec) before app start.","If using a token-refreshing sidecar, ensure the file path is stable and the env var points to it.","Document the required env var in deployment manifests for the 'test' environment."],"tags":["auth","oidc","environment","configuration","token-file"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}