mongodb/node-mongodb-native · error · MongoCryptInvalidArgumentError

Cannot set both proxyOptions and kmsConnectCallback

Error message

Cannot set both proxyOptions and kmsConnectCallback

What it means

Thrown by AutoEncrypter constructor (MongoCryptInvalidArgumentError) when both proxyOptions (with a proxyHost) and kmsConnectCallback are supplied in autoEncryption config. The two are alternative mechanisms for routing KMS (Key Management Service) traffic; supplying both is ambiguous so the driver rejects it at construction time.

Source

Thrown at src/client-side-encryption/auto_encrypter.ts:254

   *       cryptSharedLibRequired: true
   *     }
   *   }
   * });
   * ```
   *
   * await client.connect();
   * // From here on, the client will be encrypting / decrypting automatically
   */
  constructor(client: MongoClient, options: AutoEncryptionOptions) {
    this._client = client;
    this._bypassEncryption = options.bypassAutoEncryption === true;

    this._keyVaultNamespace = options.keyVaultNamespace || 'admin.datakeys';
    this._keyVaultClient = options.keyVaultClient || client;
    this._metaDataClient = options.metadataClient || client;
    this._proxyOptions = options.proxyOptions || {};
    if (this._proxyOptions.proxyHost && options.kmsConnectCallback) {
      throw new MongoCryptInvalidArgumentError(
        'Cannot set both proxyOptions and kmsConnectCallback'
      );
    }
    this._tlsOptions = options.tlsOptions || {};
    this._kmsConnectCallback = options.kmsConnectCallback;
    this._kmsProviders = options.kmsProviders || {};
    this._credentialProviders = options.credentialProviders;

    if (options.credentialProviders?.aws && !isEmptyCredentials('aws', this._kmsProviders)) {
      throw new MongoCryptInvalidArgumentError(
        'Can only provide a custom AWS credential provider when the state machine is configured for automatic AWS credential fetching'
      );
    }

    const mongoCryptOptions: MongoCryptOptions = {
      errorWrapper: defaultErrorWrapper
    };
    if (options.schemaMap) {

View on GitHub (pinned to 3366c21a63)

Solutions

1. Choose one KMS transport customization: keep kmsConnectCallback and remove proxyOptions (or vice-versa).
2. If you need proxying inside a custom callback, implement the proxy logic inside kmsConnectCallback and drop proxyOptions.
3. Audit the autoEncryption config object for leftover fields from prior setups.

Example fix

// before
autoEncryption: {
  kmsProviders: { aws: {} },
  proxyOptions: { proxyHost: 'corp.proxy', proxyPort: 3128 },
  kmsConnectCallback: myCb
}

// after
autoEncryption: {
  kmsProviders: { aws: {} },
  kmsConnectCallback: myCb // handles proxy internally
}

function validateAutoEncryption(opt) {
  if (opt.proxyOptions?.proxyHost && opt.kmsConnectCallback)
    throw new Error('Cannot set both proxyOptions and kmsConnectCallback');
}

type KmsTransport = { proxyOptions: { proxyHost: string } } | { kmsConnectCallback: Function };
// Use a union so only one variant compiles.

try { new MongoClient(uri, { autoEncryption: opt }); }
catch (err) {
  if (err instanceof MongoCryptInvalidArgumentError && /proxyOptions and kmsConnectCallback/.test(err.message)) {
    /* drop one option and retry construction */
  } else throw err;
}

When it happens

Trigger: Configuring MongoClient with autoEncryption.extraOptions or top-level proxyOptions that include proxyHost, AND also setting autoEncryption.kmsConnectCallback.

Common situations: Migrating from proxyOptions to kmsConnectCallback without removing the old field; copy-pasting examples that combine both; integrating corporate-proxy support with a custom KMS callback.

Related errors

• Cannot set both proxyOptions and kmsConnectCallback
• Can only provide a custom AWS credential provider when the s
• Can only provide a custom AWS credential provider when the s
• `cryptSharedLibRequired` set but no crypt_shared library loa
• Missing required option `keyVaultNamespace`

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/ef3be7128e9dd93e.json. Report an issue: GitHub.