mongodb/node-mongodb-native · error · MongoInvalidArgumentError

No AuthProvider for ${credentials.mechanism} defined.

Error message

No AuthProvider for ${credentials.mechanism} defined.

What it means

Thrown in prepareHandshakeDocument for a non-default credentials.mechanism when getOrCreateProvider(mechanism) returns undefined. Unlike error 104 this is the general case: the user named a specific mechanism but the registry has no provider for it. This is the prepare-stage twin of error 101; 101 checks before the handshake and 105 checks while building the handshake document.

Source

Thrown at src/cmap/connect.ts:277

      const provider = authContext.options.authProviders.getOrCreateProvider(
        AuthMechanism.MONGODB_SCRAM_SHA256,
        credentials.mechanismProperties
      );
      if (!provider) {
        // This auth mechanism is always present.
        throw new MongoInvalidArgumentError(
          `No AuthProvider for ${AuthMechanism.MONGODB_SCRAM_SHA256} defined.`
        );
      }
      return await provider.prepare(handshakeDoc, authContext);
    }
    const provider = authContext.options.authProviders.getOrCreateProvider(
      credentials.mechanism,
      credentials.mechanismProperties
    );
    if (!provider) {
      throw new MongoInvalidArgumentError(`No AuthProvider for ${credentials.mechanism} defined.`);
    }
    return await provider.prepare(handshakeDoc, authContext);
  }
  return handshakeDoc;
}

/**
 * @internal
 * Default TCP keepAlive initial delay in milliseconds.
 * Set to half the Azure load balancer idle timeout (240s) to ensure
 * probes fire well before cloud LBs (Azure, AWS PrivateLink/NLB)
 * drop idle connections.
 */
export const DEFAULT_KEEP_ALIVE_INITIAL_DELAY_MS = 120_000;

/** @public */
export const LEGAL_TLS_SOCKET_OPTIONS = [
  'allowPartialTrustChain',

View on GitHub (pinned to 3366c21a63)

Solutions

  1. Confirm the mechanism string matches a registered provider name exactly (case-sensitive).
  2. Install the optional dependency required by the mechanism (kerberos for GSSAPI, aws-sdk for MONGODB-AWS).
  3. Drop the explicit authMechanism and let the driver negotiate.
  4. If you pass a custom authProviders, ensure it registers a provider for the mechanism you named in credentials.

Example fix

// before
new MongoClient(uri, { auth: { username: 'u', password: 'p', mechanism: 'MONGODB-CR' } });

// after
new MongoClient(uri, { auth: { username: 'u', password: 'p' } }); // negotiate SCRAM
Defensive patterns

Strategy: validation

Validate before calling

import { AuthMechanism } from 'mongodb';
const KNOWN = new Set(Object.values(AuthMechanism));
function validateNamedMechanism(m: string) {
  if (!KNOWN.has(m as AuthMechanism)) {
    throw new Error(`No provider for mechanism ${m}; pick from ${[...KNOWN].join(', ')}`);
  }
}

Type guard

import { AuthMechanism } from 'mongodb';
function isKnownMechanism(m: string): m is AuthMechanism {
  return Object.values(AuthMechanism).includes(m as AuthMechanism);
}

Try / catch

import { MongoInvalidArgumentError } from 'mongodb';
try {
  await client.connect();
} catch (e) {
  if (e instanceof MongoInvalidArgumentError && /No AuthProvider for/.test(e.message)) {
    // remove the explicit mechanism or install the optional dep it needs
  }
  throw e;
}

Prevention

When it happens

Trigger: Constructing MongoClient with credentials whose mechanism is not 'MONGODB-CR' and is not registered. Fires synchronously inside prepareHandshakeDocument (src/cmap/connect.ts:272-278) during the first command on a new connection.

Common situations: Specifying an authMechanism the driver doesn't support (e.g. 'MONGODB-CR' literal in newer driver builds where it was removed, or a future mechanism on an old driver); a custom authProviders registry missing the named mechanism; optional dependency for the mechanism not installed (kerberos for GSSAPI).

Related errors

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/8cc25b4e02817159.json. Report an issue: GitHub.