mongodb/node-mongodb-native · error · MongoInvalidArgumentError

No password is allowed in ENVIRONMENT '${this.mechanismPrope

Error message

No password is allowed in ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' for '${this.mechanism}'.

What it means

Thrown for MONGODB-OIDC when both username and password are set. OIDC is a token-based mechanism; supplying a password is invalid. (Note: the message references ENVIRONMENT but the check fires for any OIDC config with username+password; ENVIRONMENT may be undefined in the rendered message.)

Source

Thrown at src/cmap/auth/mongo_credentials.ts:203

        this.mechanism === AuthMechanism.MONGODB_SCRAM_SHA256) &&
      !this.username
    ) {
      throw new MongoMissingCredentialsError(`Username required for mechanism '${this.mechanism}'`);
    }

    if (this.mechanism === AuthMechanism.MONGODB_OIDC) {
      if (
        this.username &&
        this.mechanismProperties.ENVIRONMENT &&
        this.mechanismProperties.ENVIRONMENT !== 'azure'
      ) {
        throw new MongoInvalidArgumentError(
          `username and ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' may not be used together for mechanism '${this.mechanism}'.`
        );
      }

      if (this.username && this.password) {
        throw new MongoInvalidArgumentError(
          `No password is allowed in ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' for '${this.mechanism}'.`
        );
      }

      if (
        (this.mechanismProperties.ENVIRONMENT === 'azure' ||
          this.mechanismProperties.ENVIRONMENT === 'gcp') &&
        !this.mechanismProperties.TOKEN_RESOURCE
      ) {
        throw new MongoInvalidArgumentError(TOKEN_RESOURCE_MISSING_ERROR);
      }

      if (
        this.mechanismProperties.ENVIRONMENT &&
        !ALLOWED_ENVIRONMENT_NAMES.includes(this.mechanismProperties.ENVIRONMENT)
      ) {
        throw new MongoInvalidArgumentError(
          `Currently only a ENVIRONMENT in ${ALLOWED_ENVIRONMENT_NAMES.join(

View on GitHub (pinned to 3366c21a63)

Solutions

Remove the password from the connection string / credentials when using MONGODB-OIDC.
Keep only the username if ENVIRONMENT=azure (as client_id), or remove both for machine workflows.
Re-issue the connection string without the ':password' segment.

Example fix

// before
// 'mongodb://user:pass@host/?authMechanism=MONGODB-OIDC'

// after
// 'mongodb://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=OIDC_CALLBACK:...'  // or ENVIRONMENT-based

Defensive patterns

Strategy: validation

Validate before calling

function validateOidc(opts: { username?: string; password?: string; mechanism?: string }) {
  if (opts.mechanism === 'MONGODB-OIDC' && opts.username && opts.password) {
    throw new Error('Password is not allowed for MONGODB-OIDC');
  }
}

Type guard

import { MongoInvalidArgumentError } from 'mongodb';
function isOidcPasswordForbidden(e: unknown): boolean {
  return e instanceof MongoInvalidArgumentError && /No password is allowed/.test(e.message);
}

Prevention

When migrating SCRAM->OIDC, strip the password entirely.
Treat OIDC config as token-based; never include plaintext passwords.

When it happens

Trigger: In MongoCredentials.validate() OIDC branch when this.username && this.password are both truthy.

Common situations: Reusing a SCRAM-style connection string (username:password) and just flipping authMechanism to MONGODB-OIDC; migrating from SCRAM to OIDC without removing the password.

Related errors

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/e42842f61cd6c690.json. Report an issue: GitHub.