jstedfast/MailKit · error · InvalidOperationException

The Pop3Client is already authenticated.

Error message

The Pop3Client is already authenticated.

What it means

In CheckCanAuthenticate, after confirming the client is connected, MailKit checks IsAuthenticated and throws InvalidOperationException with this message if the session is already logged in. POP3 does not support nested authentication, so calling Authenticate again on the same session is rejected as an invalid operation.

Solutions

1. Guard the call with if (!client.IsAuthenticated) client.Authenticate(...).
2. Restructure so authentication happens once per connection lifecycle, not per operation.
3. If re-authentication is genuinely needed (different credentials), Disconnect and reconnect first, then authenticate.
4. In retry logic, check IsAuthenticated before the authenticate step rather than retrying blindly.

Example fix

// before
EnsureConnected(client);
client.Authenticate("user", "pass"); // throws if already authenticated
// after
EnsureConnected(client);
if (!client.IsAuthenticated)
    client.Authenticate("user", "pass", cancellationToken);

if (client.IsConnected && !client.IsAuthenticated)
    client.Authenticate(user, pass, cancellationToken);

try {
    client.Authenticate(user, pass, cancellationToken);
} catch (InvalidOperationException) {
    // already authenticated — safe to proceed
}

When it happens

Trigger: Calling Authenticate (or a SaslMechanism overload via saslUri) on a Pop3Client where a previous Authenticate succeeded — IsAuthenticated is already true; typically a retry path or an auth routine that runs on every request against a shared client instance.

Common situations: Retry loops that re-run the full connect+authenticate sequence without checking state; DI-singleton or long-lived Pop3Client reused across requests with per-request Authenticate calls; a framework hook (e.g. reconnect handler) that unconditionally authenticates.

Understand the failure class

Background: "Invalid state transition" errors: "status must be X, actually Y", "already rejected/charging/uninstalled", "cannot ... while running" — what they mean when a library rejects your call — this error's family across 31 libraries.

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• The Pop3Client has not been authenticated.
• No credentials could be found for the POP3 server.
• The Pop3Client must be connected before you can…
• No credentials could be found for the POP3 server.
• message

AI-assisted analysis of jstedfast/MailKit@9d3859a785 (2026-09-15). Data as JSON: /api/errors/297c36db703b7b9c. Report an issue: GitHub.

Appendix: source

Thrown at MailKit/Net/Pop3/Pop3Client.cs:779

					await Engine.RunAsync (false, cancellationToken).ConfigureAwait (false);
				} finally {
					client.detector.IsAuthenticating = false;
				}

				return pc;
			}
		}

		Uri CheckCanAuthenticate (SaslMechanism mechanism, CancellationToken cancellationToken)
		{
			if (mechanism == null)
				throw new ArgumentNullException (nameof (mechanism));

			if (!engine.IsConnected)
				throw new ServiceNotConnectedException ("The Pop3Client must be connected before you can authenticate.");

			if (IsAuthenticated)
				throw new InvalidOperationException ("The Pop3Client is already authenticated.");

			CheckDisposed ();

			cancellationToken.ThrowIfCancellationRequested ();

			return new Uri ("pop://" + engine.Uri.Host);
		}

		SaslAuthContext GetSaslAuthContext (SaslMechanism mechanism, Uri saslUri)
		{
			mechanism.ChannelBindingContext = engine.Stream!.Stream as IChannelBindingContext;
			mechanism.Uri = saslUri;

			return new SaslAuthContext (this, mechanism);
		}

		void OnAuthenticated (string message, CancellationToken cancellationToken)
		{

View on GitHub (pinned to 9d3859a785)