mongodb/node-mongodb-native · error · MongoAPIError

username and password cannot be provided when using MONGODB-

Error message

username and password cannot be provided when using MONGODB-AWS. Credentials must be provided in a manner that can be read by the AWS SDK.

What it means

Thrown (as MongoAPIError) when MONGODB-AWS is selected but username or password is present in the credentials (connection_string.ts:421-427). The driver requires AWS credentials to flow through the AWS SDK credential provider chain (env vars, shared config, IMDS, etc.), not through the connection string, so that temporary credentials, instance roles, and SSO work correctly.

Source

Thrown at src/connection_string.ts:424

      );
    }

    if (
      !(isGssapi || isX509 || isAws || isOidc) &&
      mongoOptions.dbName &&
      !allProvidedOptions.has('authSource')
    ) {
      // inherit the dbName unless GSSAPI or X509, then silently ignore dbName
      // and there was no specific authSource given
      mongoOptions.credentials = MongoCredentials.merge(mongoOptions.credentials, {
        source: mongoOptions.dbName
      });
    }

    if (isAws) {
      const { username, password } = mongoOptions.credentials;
      if (username || password) {
        throw new MongoAPIError(
          'username and password cannot be provided when using MONGODB-AWS. Credentials must be provided in a manner that can be read by the AWS SDK.'
        );
      }
      if (mongoOptions.credentials.mechanismProperties.AWS_SESSION_TOKEN) {
        throw new MongoAPIError(
          'AWS_SESSION_TOKEN cannot be provided when using MONGODB-AWS. Credentials must be provided in a manner that can be read by the AWS SDK.'
        );
      }
    }

    mongoOptions.credentials.validate();

    // Check if the only auth related option provided was authSource, if so we can remove credentials
    if (
      mongoOptions.credentials.password === '' &&
      mongoOptions.credentials.username === '' &&
      mongoOptions.credentials.mechanism === AuthMechanism.MONGODB_DEFAULT &&
      Object.keys(mongoOptions.credentials.mechanismProperties).length === 0

View on GitHub (pinned to 3366c21a63)

Solutions

1. Remove the username:password@ segment from the URI.
2. Provide AWS credentials via the standard chain: AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars, ~/.aws/credentials, an ECS/EC2 instance role, or AWS SSO.
3. For temporary credentials, set AWS_SESSION_TOKEN env var (not in the URI).

Example fix

// before
const c = new MongoClient('mongodb://AKIAxxxx:secret@host/?authMechanism=MONGODB-AWS');
// after
// set AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY in the environment
const c = new MongoClient('mongodb://host/?authMechanism=MONGODB-AWS');

const mech = opts.authMechanism ?? new URL(uri).searchParams.get('authMechanism');
const u = new URL(uri);
const hasUser = Boolean(u.username) || opts.auth?.username;
if (mech === 'MONGODB-AWS' && hasUser) {
  throw new Error('MONGODB-AWS must not include username/password in the URI; use AWS env vars');
}

When it happens

Trigger: URI like 'mongodb://AKIA...:secret@host/?authMechanism=MONGODB-AWS' or options { authMechanism: 'MONGODB-AWS', auth: { username: '...', password: '...' } }.

Common situations: Porting SCRAM-style username/password auth to AWS IAM auth and leaving the userinfo in the URI; embedding long-lived access keys in config files (which the driver deliberately discourages).

Related errors

• AWS_SESSION_TOKEN cannot be provided when using MONGODB-AWS.
• AuthContext must provide credentials.
• Server nonce does not begin with client nonce
• Server returned an invalid host: "${host}"
• Could not obtain temporary MONGODB-AWS credentials

AI-assisted analysis of mongodb/node-mongodb-native@3366c21a63 (2026-08-04). Data as JSON: /data/errors/a609a834148c4649.json. Report an issue: GitHub.