jstedfast/MailKit · error · AuthenticationException

No credentials could be found for the IMAP server.

Error message

No credentials could be found for the IMAP server.

What it means

When SASL mechanisms fail or are unavailable, MailKit falls back to the classic LOGIN command using credentials from ICredentials.GetCredential(uri, "DEFAULT"). This AuthenticationException is thrown when that lookup returns null — i.e. the supplied ICredentials object has no credential matching the IMAP server URI for the default auth type.

Solutions

1. Pass a NetworkCredential directly instead of a CredentialCache so GetCredential always resolves
2. If using CredentialCache, add an entry matching the exact uri and authType: cache.Add (uri, "DEFAULT", new NetworkCredential (user, pass))
3. Verify the Uri passed to Authenticate matches the one registered in the cache (scheme imap/imaps, host, port)
4. Check server capabilities and use a SASL mechanism (SaslMechanismLogin/OAuth2) rather than the ICredentials overload

Example fix

// before
var cache = new CredentialCache (); // no matching entry
cache.Add (new Uri ("http://mail.example.com"), "BASIC", cred);
client.Authenticate (new Uri ("imaps://mail.example.com"), cache); // throws
// after
client.Authenticate (new Uri ("imaps://mail.example.com"),
    new NetworkCredential (user, pass));

var cred = credentials.GetCredential (uri, "DEFAULT"); if (cred == null) throw new InvalidOperationException ($"No credential registered for {uri}");

null

try { client.Authenticate (uri, credentials); } catch (AuthenticationException ex) when (ex.Message.Contains ("No credentials could be found")) { // fix CredentialCache entry or pass NetworkCredential
}

When it happens

Trigger: Calling Authenticate(uri, ICredentials) with a CredentialCache (or NetworkCredential-based ICredentials) that has no entry for the server URI/authType "DEFAULT", after SASL attempts did not apply, so GetCredential returns null.

Common situations: Passing an empty CredentialCache; registering credentials for a different URI prefix (http instead of imap) or wrong auth type string; using Windows-domain CredentialCache entries that don't match the IMAP host.

Related errors

• Value cannot be null. (Parameter 'userName')
• Value cannot be null. (Parameter 'password')
• No credentials could be found for the IMAP server.
• The ImapClient is already authenticated.
• The LOGIN command is disabled.

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/a700840f115df0b8. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Imap/ImapClient.cs:1352

					if (id != identifier) {
						engine.FolderCache.Clear ();
						identifier = id;
					}

					// Query the CAPABILITIES again if the server did not include an
					// untagged CAPABILITIES response to the AUTHENTICATE command.
					if (engine.CapabilitiesVersion == capabilitiesVersion)
						engine.QueryCapabilities (cancellationToken);

					OnAuthenticated (ic.ResponseText ?? string.Empty, cancellationToken);
					return;
				}

				CheckCanLogin (ic);

				// fall back to the classic LOGIN command...
				if ((cred = credentials.GetCredential (uri, "DEFAULT")) == null)
					throw new AuthenticationException ("No credentials could be found for the IMAP server.");

				ic = engine.QueueCommand (cancellationToken, null, "LOGIN %S %S\r\n", cred.UserName, cred.Password);

				detector.IsAuthenticating = true;

				try {
					engine.Run (ic);
				} finally {
					detector.IsAuthenticating = false;
				}

				if (ic.Response != ImapCommandResponse.Ok)
					throw CreateAuthenticationException (ic);

				engine.State = ImapEngineState.Authenticated;

				id = GetSessionIdentifier (cred.UserName);
				if (id != identifier) {

View on GitHub (pinned to 9d3859a785)