What causes "missing 'password' parameter for non-IAM user" in googleapis/mcp-toolbox?

Supply a non-empty password parameter for BUILT_IN users.

missing 'password' parameter for non-IAM user

Error message

missing 'password' parameter for non-IAM user

What it means

Validation error in CreateUsers: when the new user is not an IAM user (user.Type = BUILT_IN), Cloud SQL requires a password, but an empty password string was supplied. The library fails fast before calling the API.

Source

Thrown at internal/sources/cloudsqladmin/cloud_sql_admin.go:215

	return resp, nil
}

func (s *Source) CreateUsers(ctx context.Context, project, instance, name, password string, iamUser bool, accessToken string) (any, error) {
	service, err := s.GetService(ctx, accessToken)
	if err != nil {
		return nil, err
	}

	user := sqladmin.User{
		Name: name,
	}

	if iamUser {
		user.Type = "CLOUD_IAM_USER"
	} else {
		user.Type = "BUILT_IN"
		if password == "" {
			return nil, fmt.Errorf("missing 'password' parameter for non-IAM user")
		}
		user.Password = password
	}

	resp, err := service.Users.Insert(project, instance, &user).Do()
	if err != nil {
		return nil, fmt.Errorf("error creating user: %w", err)
	}

	return resp, nil
}

func (s *Source) GetInstance(ctx context.Context, projectId, instanceId, accessToken string) (any, error) {
	service, err := s.GetService(ctx, accessToken)
	if err != nil {
		return nil, err
	}

View on GitHub (pinned to 8cc6e09de2)

Solutions

Supply a non-empty password parameter for BUILT_IN users.
If the account should authenticate via IAM, set iamUser: true so no password is required.
Fix the client/tool config so password is a required parameter for non-IAM users.
Check that the secret/env var feeding the password is actually set and non-empty.

Example fix

// before
CreateUsers(ctx, project, instance, "appuser", "", false, token)
// after
CreateUsers(ctx, project, instance, "appuser", "s3curePass!", false, token)
// or for IAM auth:
CreateUsers(ctx, project, instance, "appuser", "", true, token)

Defensive patterns

Strategy: validation

Validate before calling

func validateUserParams(name, password string, iamUser bool) error {
    if strings.TrimSpace(name) == "" {
        return fmt.Errorf("user name is required")
    }
    if !iamUser && strings.TrimSpace(password) == "" {
        return fmt.Errorf("password is required for non-IAM (BUILT_IN) users")
    }
    return nil
}

Type guard

func needsPassword(iamUser bool) bool {
    return !iamUser
}

Try / catch

out, err := src.CreateUsers(ctx, project, instance, name, password, iamUser, token)
if err != nil {
    if strings.Contains(err.Error(), "missing 'password' parameter") {
        return fmt.Errorf("client error: supply a password or set iamUser=true: %w", err)
    }
    return fmt.Errorf("create user failed: %w", err)
}

Prevention

Mark the password parameter as required in the tool config for non-IAM flows.
Set iamUser: true when creating IAM-authenticated users.
Populate passwords from secrets managers, never hard-code, but verify non-empty before sending.
Validate all tool parameters in the calling client before invoking.

When it happens

Trigger: Invoking the create_user tool (or CreateUsers directly) without the password parameter, or with password: "" while iamUser is false/omitted.

Common situations: Tool configs where the password parameter was marked optional or omitted by the LLM; intending an IAM user but forgetting to pass iamUser: true; empty-string password from an unset environment variable.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

AI-assisted analysis of googleapis/mcp-toolbox@8cc6e09de2 (2026-09-05). Data as JSON: /api/errors/d94256a27f4733e9. Report an issue: GitHub.