{"id":"f3a4b397db78e5f2","repo":"mongodb/node-mongodb-native","slug":"token-resource-must-be-set-in-the-auth-mechanism-p","errorCode":null,"errorMessage":"TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure or gcp.","messagePattern":"TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure or gcp\\.","errorType":"validation","errorClass":"MongoInvalidArgumentError","httpStatus":null,"severity":"error","filePath":"src/cmap/auth/mongo_credentials.ts","lineNumber":213,"sourceCode":"        this.mechanismProperties.ENVIRONMENT !== 'azure'\n      ) {\n        throw new MongoInvalidArgumentError(\n          `username and ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' may not be used together for mechanism '${this.mechanism}'.`\n        );\n      }\n\n      if (this.username && this.password) {\n        throw new MongoInvalidArgumentError(\n          `No password is allowed in ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' for '${this.mechanism}'.`\n        );\n      }\n\n      if (\n        (this.mechanismProperties.ENVIRONMENT === 'azure' ||\n          this.mechanismProperties.ENVIRONMENT === 'gcp') &&\n        !this.mechanismProperties.TOKEN_RESOURCE\n      ) {\n        throw new MongoInvalidArgumentError(TOKEN_RESOURCE_MISSING_ERROR);\n      }\n\n      if (\n        this.mechanismProperties.ENVIRONMENT &&\n        !ALLOWED_ENVIRONMENT_NAMES.includes(this.mechanismProperties.ENVIRONMENT)\n      ) {\n        throw new MongoInvalidArgumentError(\n          `Currently only a ENVIRONMENT in ${ALLOWED_ENVIRONMENT_NAMES.join(\n            ','\n          )} is supported for mechanism '${this.mechanism}'.`\n        );\n      }\n\n      if (\n        !this.mechanismProperties.ENVIRONMENT &&\n        !this.mechanismProperties.OIDC_CALLBACK &&\n        !this.mechanismProperties.OIDC_HUMAN_CALLBACK\n      ) {","sourceCodeStart":195,"sourceCodeEnd":231,"githubUrl":"https://github.com/mongodb/node-mongodb-native/blob/3366c21a6311e02f1be91da982f9b93d3cce99a0/src/cmap/auth/mongo_credentials.ts#L195-L231","documentation":"Thrown for MONGODB-OIDC when ENVIRONMENT is 'azure' or 'gcp' but TOKEN_RESOURCE is not set. The TOKEN_RESOURCE is the audience (e.g. https://vault.azure.net or a GCP service account) the managed-identity token is requested for; without it the machine workflow cannot fetch a valid OIDC token.","triggerScenarios":"In MongoCredentials.validate() when ENVIRONMENT is azure/gcp and mechanismProperties.TOKEN_RESOURCE is missing.","commonSituations":"Setting authMechanismProperties=ENVIRONMENT:azure without TOKEN_RESOURCE; copy/paste OIDC config that omitted the audience; forgetting to register the application URI in Azure.","solutions":["Add TOKEN_RESOURCE to authMechanismProperties: 'ENVIRONMENT:azure,TOKEN_RESOURCE:https://vault.azure.net'.","For GCP, set TOKEN_RESOURCE to the service-account audience for your IdP.","Verify the TOKEN_RESOURCE matches the audience expected by the MongoDB cluster OIDC configuration."],"exampleFix":"// before\n'mongodb://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:azure'\n\n// after\n'mongodb://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:azure,TOKEN_RESOURCE:https://vault.azure.net'","handlingStrategy":"validation","validationCode":"function validateOidcEnv(props?: { ENVIRONMENT?: string; TOKEN_RESOURCE?: string }) {\n  if (props && (props.ENVIRONMENT === 'azure' || props.ENVIRONMENT === 'gcp') && !props.TOKEN_RESOURCE) {\n    throw new Error('TOKEN_RESOURCE required for ' + props.ENVIRONMENT);\n  }\n}","typeGuard":"import { MongoInvalidArgumentError } from 'mongodb';\nfunction isTokenResourceMissing(e: unknown): boolean {\n  return e instanceof MongoInvalidArgumentError && /TOKEN_RESOURCE must be set/.test(e.message);\n}","tryCatchPattern":null,"preventionTips":["Always pair ENVIRONMENT:azure/gcp with the correct TOKEN_RESOURCE audience.","Confirm the audience matches the cluster-side OIDC configuration."],"tags":["auth","oidc","azure","gcp","configuration"],"analyzedSha":"3366c21a6311e02f1be91da982f9b93d3cce99a0","analyzedAt":"2026-08-04T13:40:15.335Z","schemaVersion":2}