jstedfast/MailKit · error · AuthenticationException

No credentials could be found for the IMAP server.

Error message

No credentials could be found for the IMAP server.

What it means

During IMAP authentication, after SASL mechanisms are exhausted, ImapClient falls back to the classic LOGIN command and looks up credentials via the supplied ICredentials.GetCredential(uri, "DEFAULT"). If that returns null, no credentials are available at all, so an AuthenticationException is thrown.

Solutions

1. Verify the ICredentials implementation returns a non-null NetworkCredential for the server URI
2. If using CredentialCache, register the credential for the exact host, port, and auth type used to connect
3. Load credentials (user/password) before connecting and pass them via Authenticate(user, password) instead of the ICredentials overload

Example fix

// before
client.Connect(uri);
client.Authenticate(credentials); // CredentialCache has no entry for this host
// after
client.Connect(uri);
client.Authenticate("user@example.com", "app-password");

var cred = credentials.GetCredential(uri, "DEFAULT");
if (cred == null || string.IsNullOrEmpty(cred.UserName))
	throw new InvalidOperationException($"No credential registered for {uri.Host}:{uri.Port}");

bool HasCredential(ICredentials creds, Uri uri) => creds?.GetCredential(uri, "DEFAULT") != null;

try {
	await client.AuthenticateAsync(credentials);
} catch (AuthenticationException ex) {
	// log which host/uri lacked credentials, load from secret store and retry once
}

When it happens

Trigger: Calling ImapClient.Authenticate ICredentials whose GetCredential returns null for the server's host/port/authType (e.g. NetworkCredential created empty, or a custom ICredentials that does not match the URI).

Common situations: Using CredentialCache with credentials registered for the wrong host/port; a custom credential store that has no entry for this server; credentials cleared or not loaded from a secrets store at runtime.

Related errors

• No credentials could be found for the IMAP server.
• Value cannot be null. (Parameter 'userName')
• Value cannot be null. (Parameter 'password')
• The IMAP server does not support the STARTTLS extension.
• The ImapClient is not connected.

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/3abc9f17a3f7f774. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Imap/AsyncImapClient.cs:472

					if (id != identifier) {
						engine.FolderCache.Clear ();
						identifier = id;
					}

					// Query the CAPABILITIES again if the server did not include an
					// untagged CAPABILITIES response to the AUTHENTICATE command.
					if (engine.CapabilitiesVersion == capabilitiesVersion)
						await engine.QueryCapabilitiesAsync (cancellationToken).ConfigureAwait (false);

					await OnAuthenticatedAsync (ic.ResponseText ?? string.Empty, cancellationToken).ConfigureAwait (false);
					return;
				}

				CheckCanLogin (ic);

				// fall back to the classic LOGIN command...
				if ((cred = credentials.GetCredential (uri, "DEFAULT")) == null)
					throw new AuthenticationException ("No credentials could be found for the IMAP server.");

				ic = engine.QueueCommand (cancellationToken, null, "LOGIN %S %S\r\n", cred.UserName, cred.Password);

				detector.IsAuthenticating = true;

				try {
					await engine.RunAsync (ic).ConfigureAwait (false);
				} finally {
					detector.IsAuthenticating = false;
				}

				if (ic.Response != ImapCommandResponse.Ok)
					throw CreateAuthenticationException (ic);

				engine.State = ImapEngineState.Authenticated;

				id = GetSessionIdentifier (cred.UserName);
				if (id != identifier) {

View on GitHub (pinned to 9d3859a785)