mongodb/node-mongodb-native · error · MongoInvalidArgumentError

Option "autoEncryption" must be specified

Error message

Option "autoEncryption" must be specified

What it means

The Encrypter is constructed only when autoEncryption is enabled on MongoClient. Reaching its constructor with a non-object autoEncryption means the option was set to a truthy non-object (boolean, string) — a misconfiguration the driver catches at client construction time.

Source

Thrown at src/encrypter.ts:22

import { MongoInvalidArgumentError, MongoMissingDependencyError } from './error';
import { MongoClient, type MongoClientOptions } from './mongo_client';

/** @internal */
export interface EncrypterOptions {
  autoEncryption: AutoEncryptionOptions;
  maxPoolSize?: number;
}

/** @internal */
export class Encrypter {
  private internalClient: MongoClient | null;
  bypassAutoEncryption: boolean;
  needsConnecting: boolean;
  autoEncrypter: AutoEncrypter;

  constructor(client: MongoClient, uri: string, options: MongoClientOptions) {
    if (typeof options.autoEncryption !== 'object') {
      throw new MongoInvalidArgumentError('Option "autoEncryption" must be specified');
    }
    // initialize to null, if we call getInternalClient, we may set this it is important to not overwrite those function calls.
    this.internalClient = null;

    this.bypassAutoEncryption = !!options.autoEncryption.bypassAutoEncryption;
    this.needsConnecting = false;

    if (options.maxPoolSize === 0 && options.autoEncryption.keyVaultClient == null) {
      options.autoEncryption.keyVaultClient = client;
    } else if (options.autoEncryption.keyVaultClient == null) {
      options.autoEncryption.keyVaultClient = this.getInternalClient(client, uri, options);
    }

    if (this.bypassAutoEncryption) {
      options.autoEncryption.metadataClient = undefined;
    } else if (options.maxPoolSize === 0) {
      options.autoEncryption.metadataClient = client;
    } else {

View on GitHub (pinned to 3366c21a63)

Solutions

1. Set autoEncryption to an object with at least keyVaultNamespace and kmsProviders
2. Confirm the option is an object literal, not a boolean or string
3. Follow the CSFLE setup tutorial for the full options shape

Example fix

// before
new MongoClient(uri, { autoEncryption: true });
// after
new MongoClient(uri, {
  autoEncryption: {
    keyVaultNamespace: 'encryption.__keyVault',
    kmsProviders: { local: { key: localKey } }
  }
});

if (options.autoEncryption != null && typeof options.autoEncryption !== 'object') {
  throw new Error('autoEncryption must be an object with keyVaultNamespace and kmsProviders');
}

function isAutoEncryptionOptions(o: unknown): o is { keyVaultNamespace: string; kmsProviders: Record<string, unknown> } {
  return typeof o === 'object' && o !== null
    && typeof (o as any).keyVaultNamespace === 'string'
    && typeof (o as any).kmsProviders === 'object';
}

When it happens

Trigger: new MongoClient(uri, { autoEncryption: true }), autoEncryption: 'enabled', or any non-object value for the option.

Common situations: Booleans mistaken for option flags; partial config; copying examples that omit the keyVaultNamespace/kmsProviders shape.

Related errors

• "options" cannot contain both "keyId" and "keyAltName"
• "options.keyAltName" must be of type string, but was of type
• No AutoEncrypter available for encryption
• Auto-encryption requested, but the module is not installed.
• Expected result of decryption to be deserialized BSON object

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/2045163e13bdafaa.json. Report an issue: GitHub.