mongodb/node-mongodb-native · error · MongoGCPError

Status code ${response.status} returned from the GCP endpoin

Error message

Status code ${response.status} returned from the GCP endpoint. Response body: ${response.body}

What it means

Thrown by the GCP machine workflow when the GCP metadata service returns an HTTP status other than 200 (src/cmap/auth/mongodb_oidc/gcp_machine_workflow.ts:40). The error includes the status code and response body. The driver requests http://metadata/computeMetadata/v1/instance/service-accounts/default/identity?audience=<TOKEN_RESOURCE> with the Metadata-Flavor: Google header. Surfaced as a MongoGCPError.

Source

Thrown at src/cmap/auth/mongodb_oidc/gcp_machine_workflow.ts:41

): Promise<OIDCResponse> => {
  const tokenAudience = params.tokenAudience;
  if (!tokenAudience) {
    throw new MongoGCPError(TOKEN_RESOURCE_MISSING_ERROR);
  }
  return await getGcpTokenData(tokenAudience);
};

/**
 * Hit the GCP endpoint to get the token data.
 */
async function getGcpTokenData(tokenAudience: string): Promise<OIDCResponse> {
  const url = new URL(GCP_BASE_URL);
  url.searchParams.append('audience', tokenAudience);
  const response = await get(url, {
    headers: GCP_HEADERS
  });
  if (response.status !== 200) {
    throw new MongoGCPError(
      `Status code ${response.status} returned from the GCP endpoint. Response body: ${response.body}`
    );
  }
  return { accessToken: response.body };
}

View on GitHub (pinned to 3366c21a63)

Solutions

1. Read the response body in the error to see GCP's explanation.
2. Ensure the GCE instance or GKE node has a service account attached with the appropriate scopes (cloud-platform).
3. Confirm the TOKEN_RESOURCE audience is valid and permitted for the service account.
4. If not on GCP, switch ENVIRONMENT to the correct provider.

try {
  await client.connect();
} catch (e) {
  if (e instanceof MongoGCPError && /Status code \d+ returned from the GCP endpoint/.test(e.message)) {
    // Inspect e.message for the GCP response body, verify service account and audience
    log.error('GCP metadata token error', e.message);
  }
  throw e;
}

When it happens

Trigger: The GCP metadata request returns non-200 - e.g. 403/404 when no service account is attached, 400 for an invalid audience, or any error when the workload is not running on GCE/GKE.

Common situations: The compute instance has no default service account, the service account lacks permission to mint tokens for the requested audience, the workload runs outside GCP (so 'metadata' does not resolve), or a network policy blocks the metadata endpoint.

Related errors

• TOKEN_RESOURCE must be set in the auth mechanism properties
• OIDC callback timed out after ${AUTOMATED_TIMEOUT_MS}ms.
• Status code ${response.status} returned from the Azure endpo
• TOKEN_RESOURCE must be set in the auth mechanism properties
• username and ENVIRONMENT '${this.mechanismProperties.ENVIRON

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/69b67bb264034efd.json. Report an issue: GitHub.