jstedfast/MailKit · error · AuthenticationException

No credentials could be found for the POP3 server.

Error message

No credentials could be found for the POP3 server.

What it means

During Authenticate, after no advertised SASL mechanism matches the supplied ICredentials, Pop3Client falls back to the classic USER/PASS commands and asks the ICredentials instance for a credential via GetCredential(saslUri, "DEFAULT"). When that returns null the library throws AuthenticationException because there is nothing to authenticate with. This means the credential store has no entry matching the POP3 host URI for the default auth type.

Solutions

1. Pass a concrete credential (e.g., new NetworkCredential(user, pass)) instead of an empty/mismatched CredentialCache.
2. If using CredentialCache, add an entry keyed by the pop:// URI with the exact host and authType "DEFAULT" or use the AddCredential overload matching the server's advertised mechanisms.
3. Verify the credential's UserName/Password are non-empty and the host matches the one passed to Connect.
4. Alternatively use Authenticate(SaslMechanism, ...) with an explicitly constructed mechanism such as SaslMechanism.Login or SaslMechanism.Plain.

Example fix

// before
var cache = new CredentialCache(); // empty -> no credential for pop://host
client.Authenticate(cache, cancellationToken);

// after
var credentials = new NetworkCredential("user@example.com", "password");
client.Authenticate(credentials, cancellationToken);

// pre-flight: make sure the credential store resolves for the pop:// URI
var saslUri = new Uri("pop://" + host);
if (credentials is CredentialCache cache && cache.GetCredential(saslUri, "DEFAULT") == null)
    throw new InvalidOperationException($"No credential registered for {saslUri}");

try {
    client.Authenticate(credentials, cancellationToken);
} catch (AuthenticationException) {
    // fall back to explicit credentials or surface a config error
    client.Authenticate(new NetworkCredential(user, pass), cancellationToken);
}

When it happens

Trigger: Calling Authenticate(ICredentials, ...) where credentials.GetCredential(new Uri("pop://host"), "DEFAULT") returns null — e.g., an empty NetworkCredential collection, or credentials registered for a different host/URI/authType than the pop:// URI the client built.

Common situations: Using CredentialCache with entries keyed by "http://host" or a different port/host than the POP3 server; passing a CredentialCache with no matching entry; forgetting to populate credentials after loading config; host name mismatch (case/suffix) between the cache entry and the connected host.

Related errors

• No credentials could be found for the POP3 server.
• Value cannot be null. (Parameter 'userName')
• Value cannot be null. (Parameter 'password')
• No credentials could be found for the IMAP server.
• The Pop3Client has not been authenticated.

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/d40493093b677c5d. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Pop3/Pop3Client.cs:1022

						cancellationToken.ThrowIfCancellationRequested ();

						var ctx = GetSaslAuthContext (sasl, saslUri);

						var pc = ctx.Authenticate (cancellationToken);

						if (pc.Status == Pop3CommandStatus.Error)
							continue;

						pc.ThrowIfError ();

						OnAuthenticated (ctx.AuthMessage!, cancellationToken);
						return;
					}
				}

				// fall back to the classic USER & PASS commands...
				if ((cred = credentials.GetCredential (saslUri, "DEFAULT")) == null)
					throw new AuthenticationException ("No credentials could be found for the POP3 server.");

				userName = utf8 ? SaslMechanism.SaslPrep (cred.UserName) : cred.UserName;
				password = utf8 ? SaslMechanism.SaslPrep (cred.Password) : cred.Password;
				detector.IsAuthenticating = true;

				try {
					SendCommand (cancellationToken, encoding, "USER {0}\r\n", userName);
					message = SendCommand (cancellationToken, encoding, "PASS {0}\r\n", password);
				} catch (Pop3CommandException) {
					throw new AuthenticationException ();
				} finally {
					detector.IsAuthenticating = false;
				}

				OnAuthenticated (message, cancellationToken);
			} catch (Exception ex) {
				operation.SetError (ex);
				throw;

View on GitHub (pinned to 9d3859a785)