mongodb/node-mongodb-native · error · MongoInvalidArgumentError

TOKEN_RESOURCE must be set in the auth mechanism properties

Error message

TOKEN_RESOURCE must be set in the auth mechanism properties when ENVIRONMENT is azure or gcp.

What it means

Thrown for MONGODB-OIDC when ENVIRONMENT is 'azure' or 'gcp' but TOKEN_RESOURCE is not set. The TOKEN_RESOURCE is the audience (e.g. https://vault.azure.net or a GCP service account) the managed-identity token is requested for; without it the machine workflow cannot fetch a valid OIDC token.

Source

Thrown at src/cmap/auth/mongo_credentials.ts:213

        this.mechanismProperties.ENVIRONMENT !== 'azure'
      ) {
        throw new MongoInvalidArgumentError(
          `username and ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' may not be used together for mechanism '${this.mechanism}'.`
        );
      }

      if (this.username && this.password) {
        throw new MongoInvalidArgumentError(
          `No password is allowed in ENVIRONMENT '${this.mechanismProperties.ENVIRONMENT}' for '${this.mechanism}'.`
        );
      }

      if (
        (this.mechanismProperties.ENVIRONMENT === 'azure' ||
          this.mechanismProperties.ENVIRONMENT === 'gcp') &&
        !this.mechanismProperties.TOKEN_RESOURCE
      ) {
        throw new MongoInvalidArgumentError(TOKEN_RESOURCE_MISSING_ERROR);
      }

      if (
        this.mechanismProperties.ENVIRONMENT &&
        !ALLOWED_ENVIRONMENT_NAMES.includes(this.mechanismProperties.ENVIRONMENT)
      ) {
        throw new MongoInvalidArgumentError(
          `Currently only a ENVIRONMENT in ${ALLOWED_ENVIRONMENT_NAMES.join(
            ','
          )} is supported for mechanism '${this.mechanism}'.`
        );
      }

      if (
        !this.mechanismProperties.ENVIRONMENT &&
        !this.mechanismProperties.OIDC_CALLBACK &&
        !this.mechanismProperties.OIDC_HUMAN_CALLBACK
      ) {

View on GitHub (pinned to 3366c21a63)

Solutions

1. Add TOKEN_RESOURCE to authMechanismProperties: 'ENVIRONMENT:azure,TOKEN_RESOURCE:https://vault.azure.net'.
2. For GCP, set TOKEN_RESOURCE to the service-account audience for your IdP.
3. Verify the TOKEN_RESOURCE matches the audience expected by the MongoDB cluster OIDC configuration.

Example fix

// before
'mongodb://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:azure'

// after
'mongodb://host/?authMechanism=MONGODB-OIDC&authMechanismProperties=ENVIRONMENT:azure,TOKEN_RESOURCE:https://vault.azure.net'

function validateOidcEnv(props?: { ENVIRONMENT?: string; TOKEN_RESOURCE?: string }) {
  if (props && (props.ENVIRONMENT === 'azure' || props.ENVIRONMENT === 'gcp') && !props.TOKEN_RESOURCE) {
    throw new Error('TOKEN_RESOURCE required for ' + props.ENVIRONMENT);
  }
}

import { MongoInvalidArgumentError } from 'mongodb';
function isTokenResourceMissing(e: unknown): boolean {
  return e instanceof MongoInvalidArgumentError && /TOKEN_RESOURCE must be set/.test(e.message);
}

When it happens

Trigger: In MongoCredentials.validate() when ENVIRONMENT is azure/gcp and mechanismProperties.TOKEN_RESOURCE is missing.

Common situations: Setting authMechanismProperties=ENVIRONMENT:azure without TOKEN_RESOURCE; copy/paste OIDC config that omitted the audience; forgetting to register the application URI in Azure.

Related errors

• OIDC callback timed out after ${AUTOMATED_TIMEOUT_MS}ms.
• TOKEN_RESOURCE must be set in the auth mechanism properties
• TOKEN_RESOURCE must be set in the auth mechanism properties
• username and ENVIRONMENT '${this.mechanismProperties.ENVIRON
• No password is allowed in ENVIRONMENT '${this.mechanismPrope

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/f3a4b397db78e5f2.json. Report an issue: GitHub.