What causes "No AuthProvider for ${resolvedCredentials.mechanism} defined." in mongodb/node-mongodb-native?

Stop passing a custom authProviders option unless you explicitly need a custom mechanism, so the default registry (which includes SCRAM-SHA-256, SCRAM-SHA-1, X509, etc.) is used.

mongodb/node-mongodb-native · error · MongoInvalidArgumentError

No AuthProvider for ${resolvedCredentials.mechanism} defined

Error message

No AuthProvider for ${resolvedCredentials.mechanism} defined.

What it means

Thrown after the handshake completes, when credentials.resolveAuthMechanism(response) returned a concrete mechanism (e.g. the server advertised SCRAM-SHA-256 and the credentials were 'MONGODB-CR' default) but AuthProviders.getOrCreateProvider() returned undefined for that resolved mechanism. This means the driver's auth provider registry does not recognize the resolved mechanism - effectively a misregistered or stripped-down build.

Source

Thrown at src/cmap/connect.ts:165

  }

  // NOTE: This is metadata attached to the connection while porting away from
  //       handshake being done in the `Server` class. Likely, it should be
  //       relocated, or at very least restructured.
  conn.hello = response;
  conn.lastHelloMS = new Date().getTime() - start;

  if (!response.arbiterOnly && credentials) {
    // store the response on auth context
    authContext.response = response;

    const resolvedCredentials = credentials.resolveAuthMechanism(response);
    const provider = options.authProviders.getOrCreateProvider(
      resolvedCredentials.mechanism,
      resolvedCredentials.mechanismProperties
    );
    if (!provider) {
      throw new MongoInvalidArgumentError(
        `No AuthProvider for ${resolvedCredentials.mechanism} defined.`
      );
    }

    try {
      await provider.auth(authContext);
    } catch (error) {
      // NOTE: If we encounter an error authenticating a connection, do NOT apply backpressure labels.

      if (error instanceof MongoError) {
        error.addErrorLabel(MongoErrorLabel.HandshakeError);
        if (needsRetryableWriteLabel(error)) {
          error.addErrorLabel(MongoErrorLabel.RetryableWriteError);
        }
      }

      throw error;
    }

View on GitHub (pinned to 3366c21a63)

Solutions

Stop passing a custom authProviders option unless you explicitly need a custom mechanism, so the default registry (which includes SCRAM-SHA-256, SCRAM-SHA-1, X509, etc.) is used.
If you do customize authProviders, ensure you include the built-in providers (import and re-register X509/MongoDBAWS/Plain/ScramSha256/ScramSha1/OIDC/GSSAPI as needed).
Check the server's saslSupportedMechs advertisement in the hello response and ensure your custom registry covers the negotiated mechanism.
Upgrade the driver; older builds had partial provider coverage.

Example fix

// before
const client = new MongoClient(uri, { authProviders: new AuthProviders({ /* only custom */ }) });

// after
const client = new MongoClient(uri); // default registry includes SCRAM providers

Defensive patterns

Strategy: validation

Validate before calling

import { AuthMechanism } from 'mongodb';
function assertRegistryHasResolved(registry: any, resolvedMech: string) {
  if (!registry.getOrCreateProvider(resolvedMech)) {
    throw new Error(`authProviders registry missing ${resolvedMech}`);
  }
}

Type guard

function hasAllScramProviders(authProviders: any): boolean {
  return Boolean(authProviders?.getOrCreateProvider('SCRAM-SHA-256')) &&
    Boolean(authProviders?.getOrCreateProvider('SCRAM-SHA-1'));
}

Try / catch

import { MongoInvalidArgumentError } from 'mongodb';
try {
  await client.connect();
} catch (e) {
  if (e instanceof MongoInvalidArgumentError && /No AuthProvider/.test(e.message)) {
    // remove custom authProviders option and recreate client
  }
  throw e;
}

Prevention

Do not pass a custom authProviders option unless strictly necessary.
If customizing, spread the default registry and only add/override specific mechanisms.
Unit-test that your custom registry resolves every mechanism your deployment may negotiate.

When it happens

Trigger: Inside performInitialHandshake (src/cmap/connect.ts:159-168) on a non-arbiter connection that has credentials. The default mechanism resolves to SCRAM-SHA-256/SCRAM-SHA-1 normally; this fires only if a custom AuthProviders was injected (via MongoClientOptions.authProviders) that lacks the resolved mechanism, or if a custom mechanism plugin failed to register.

Common situations: Passing a custom authProviders option that does not include the standard SCRAM providers; monkeypatching the driver to remove a provider; running against a forked/patched driver build where provider registration was stripped; using a third-party auth plugin that doesn't register for the mechanism the server negotiated.

Related errors

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/c4a04995a84e68cf.json. Report an issue: GitHub.