mongodb/node-mongodb-native · error · MongoMissingCredentialsError

Connection is missing credentials when asked to reauthentica

Error message

Connection is missing credentials when asked to reauthenticate

What it means

Thrown by reauthenticate() when a connection's authContext exists but contains no credentials. Reauthentication needs the original credentials (username/password or mechanism-specific data) to re-run the handshake; their absence means the connection was created without credentials yet is being asked to reauth. Surfaced as MongoMissingCredentialsError. This typically reflects a misconfigured auth setup or an internal state loss.

Source

Thrown at src/cmap/connection_pool.ts:530

      );
      conn.destroy();
    }
    this.connections.clear();
    this.emitAndLog(ConnectionPool.CONNECTION_POOL_CLOSED, new ConnectionPoolClosedEvent(this));
  }

  /**
   * @internal
   * Reauthenticate a connection
   */
  async reauthenticate(connection: Connection): Promise<void> {
    const authContext = connection.authContext;
    if (!authContext) {
      throw new MongoRuntimeError('No auth context found on connection.');
    }
    const credentials = authContext.credentials;
    if (!credentials) {
      throw new MongoMissingCredentialsError(
        'Connection is missing credentials when asked to reauthenticate'
      );
    }

    const resolvedCredentials = credentials.resolveAuthMechanism(connection.hello);
    const provider = this.server.topology.client.s.authProviders.getOrCreateProvider(
      resolvedCredentials.mechanism,
      resolvedCredentials.mechanismProperties
    );

    if (!provider) {
      throw new MongoMissingCredentialsError(
        `Reauthenticate failed due to no auth provider for ${credentials.mechanism}`
      );
    }

    await provider.reauth(authContext);

View on GitHub (pinned to 3366c21a63)

Solutions

1. Provide credentials in the connection string or authMechanism properties so every connection carries them: `mongodb://user:pass@host/?authSource=admin`.
2. For MONGODB-OIDC or MONGODB-AWS, verify the token/credential callback returns valid credentials on the first call, not just on reauth.
3. Confirm the authMechanism in the URI matches the server's configured mechanism; mismatched mechanisms can yield empty resolved credentials.
4. Upgrade the driver to a current patch to pick up credentials-retention fixes in the reauth path.

Example fix

// before - no credentials, but server requires auth
const client = new MongoClient('mongodb://host:27017');

// after
const client = new MongoClient('mongodb://user:pass@host:27017/?authSource=admin');

// Validate credentials are present before constructing the client.
function assertCredentials(uri) {
  const u = new URL(uri);
  const hasCreds = u.username && u.password;
  if (!hasCreds && !/(authMechanism=(GSSAPI|AWS|OIDC|MONGODB-X509))/i.test(uri)) {
    throw new Error('MongoDB URI is missing credentials but server requires auth');
  }
}
assertCredentials(process.env.MONGODB_URI);

try {
  await client.connect();
} catch (err) {
  if (err instanceof MongoMissingCredentialsError) {
    console.error('Credentials missing or invalid; check the connection string auth.');
  }
  throw err;
}

When it happens

Trigger: The server demands reauthentication and the driver calls reauthenticate(connection); authContext is present but authContext.credentials is null/undefined. Happens when a connection was established without credentials (no auth configured) but something still triggered a reauth path, or when credentials were dropped from the context after initial auth. Encountered with expiring mechanisms (AWS/OIDC/Kerberos) on misconfigured clients.

Common situations: Connecting without a username/password in the URI while the server expects auth, then hitting a reauth trigger. Mixing auth and no-auth connections in a pool. Driver version where credentials were not retained on the authContext for certain mechanisms. OIDC/AWS token providers that returned no credentials initially.

Related errors

• No auth context found on connection.
• Reauthenticate failed due to no auth provider for ${credenti
• Can only provide a custom AWS credential provider when the s
• Can only provide a custom AWS credential provider when the s
• Credentials required for GSSAPI authentication

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/742a11f707efc6a8.json. Report an issue: GitHub.