mongodb/node-mongodb-native · error · MongoInvalidArgumentError

Currently only a ENVIRONMENT in ${ALLOWED_ENVIRONMENT_NAMES.

Error message

Currently only a ENVIRONMENT in ${ALLOWED_ENVIRONMENT_NAMES.join(',')} is supported for mechanism '${this.mechanism}'.

What it means

Thrown for MONGODB-OIDC when ENVIRONMENT is set to a value not in the allowed list (test, azure, gcp, k8s). The driver only knows how to fetch tokens for these specific machine-identity providers; any other ENVIRONMENT value is rejected.

Source

Thrown at src/cmap/auth/mongo_credentials.ts:220

      if (this.username && this.password) {
        throw new MongoInvalidArgumentError(
          `No password is allowed in ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' for '${this.mechanism}'.`
        );
      }

      if (
        (this.mechanismProperties.ENVIRONMENT === 'azure' ||
          this.mechanismProperties.ENVIRONMENT === 'gcp') &&
        !this.mechanismProperties.TOKEN_RESOURCE
      ) {
        throw new MongoInvalidArgumentError(TOKEN_RESOURCE_MISSING_ERROR);
      }

      if (
        this.mechanismProperties.ENVIRONMENT &&
        !ALLOWED_ENVIRONMENT_NAMES.includes(this.mechanismProperties.ENVIRONMENT)
      ) {
        throw new MongoInvalidArgumentError(
          `Currently only a ENVIRONMENT in ${ALLOWED_ENVIRONMENT_NAMES.join(
            ','
          )} is supported for mechanism '${this.mechanism}'.`
        );
      }

      if (
        !this.mechanismProperties.ENVIRONMENT &&
        !this.mechanismProperties.OIDC_CALLBACK &&
        !this.mechanismProperties.OIDC_HUMAN_CALLBACK
      ) {
        throw new MongoInvalidArgumentError(
          `Either a ENVIRONMENT, OIDC_CALLBACK, or OIDC_HUMAN_CALLBACK must be specified for mechanism '${this.mechanism}'.`
        );
      }

      if (this.mechanismProperties.ALLOWED_HOSTS) {
        const hosts = this.mechanismProperties.ALLOWED_HOSTS;

View on GitHub (pinned to 3366c21a63)

Solutions

1. Use one of: test, azure, gcp, k8s.
2. For AWS or other OIDC providers, supply OIDC_CALLBACK / OIDC_HUMAN_CALLBACK instead of ENVIRONMENT.
3. Check for capitalization and trailing spaces in the ENVIRONMENT value.

Example fix

// before
'...&authMechanismProperties=ENVIRONMENT:aws'

// after (use a callback for AWS IdP)
const client = new MongoClient(uri, {
  authMechanism: 'MONGODB-OIDC',
  authMechanismProperties: { OIDC_CALLBACK: awsCallback }
});

const ALLOWED = ['test','azure','gcp','k8s'];
function validateOidcEnvName(env?: string) {
  if (env && !ALLOWED.includes(env)) throw new Error(`Unsupported ENVIRONMENT: ${env}`);
}

import { MongoInvalidArgumentError } from 'mongodb';
function isUnsupportedEnvironment(e: unknown): boolean {
  return e instanceof MongoInvalidArgumentError && /Currently only a ENVIRONMENT in/.test(e.message);
}

When it happens

Trigger: In MongoCredentials.validate() when mechanismProperties.ENVIRONMENT is truthy but not in ALLOWED_ENVIRONMENT_NAMES.

Common situations: Typo in ENVIRONMENT (e.g. 'aws' which isn't supported via ENVIRONMENT, or 'Azure' capitalized); using an arbitrary string; copy/paste from another driver's docs that supports a different set.

Related errors

• username and ENVIRONMENT '${this.mechanismProperties.ENVIRON
• No password is allowed in ENVIRONMENT '${this.mechanismPrope
• TOKEN_RESOURCE must be set in the auth mechanism properties
• Either a ENVIRONMENT, OIDC_CALLBACK, or OIDC_HUMAN_CALLBACK
• Auth mechanism property ALLOWED_HOSTS must be an array of st

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/b6efba8df15dc4c1.json. Report an issue: GitHub.