transloadit/uppy · critical · Error

Endpoint is required for credential-based signing

Error message

Endpoint is required for credential-based signing

What it means

Thrown by s3mini's credential-based signer when no endpoint is configured. Signature Version 4 signing requires a known HTTP endpoint to build the canonical request (host header, path), so presigning with static credentials (accessKeyId/secretAccessKey) without an endpoint URL is impossible. The check runs eagerly in the constructor so the client fails fast instead of at first request.

Source

Thrown at packages/@uppy/aws-s3/src/s3-client/S3mini.ts:98

      this.signRequest = this._createCredentialBasedSigner()
    } else {
      throw new TypeError(
        'Either signRequest or getCredentials must be provided',
      )
    }

    this.region = region
    this.requestSizeInBytes = requestSizeInBytes
  }

  /** Creates a presigner that fetches/caches credentials and generates pre-signed URLs. */
  private _createCredentialBasedSigner(): IT.SignRequestFn {
    return async (
      request: IT.PresignableRequest,
    ): Promise<IT.PresignedResponse> => {
      const creds = await this._getCachedCredentials()
      if (this.endpoint == null) {
        throw new Error('Endpoint is required for credential-based signing')
      }
      const presigner = createSigV4Signer({
        accessKeyId: creds.credentials.accessKeyId,
        secretAccessKey: creds.credentials.secretAccessKey,
        sessionToken: creds.credentials.sessionToken,
        region: creds.region || this.region,
        endpoint: this.endpoint.toString(),
      })
      return presigner(request)
    }
  }

  /** Gets cached credentials or fetches new ones. */
  private async _getCachedCredentials(): Promise<IT.CredentialsResponse> {
    // Return Cached Credentials if available
    if (this.cachedCredentials != null) {
      return this.cachedCredentials
    }

View on GitHub (pinned to 5d4dedd02a)

Solutions

1. Pass a valid `endpoint` URL when constructing S3mini with credentials: `new S3mini({ endpoint: 'https://s3.us-east-1.amazonaws.com', accessKeyId, secretAccessKey, region })`.
2. If you meant path-style addressing, include the bucket in the endpoint (e.g. `https://s3.region.amazonaws.com/my-bucket`) or set the bucket option per your client's config.
3. Check for misspelled option keys (`endPoint`, `baseUrl`) that silently leave `endpoint` undefined.
4. If you want ambient/default credentials instead of static ones, configure the client so the credential-based signer isn't selected.

Example fix

// before
const s3 = new S3mini({ accessKeyId, secretAccessKey, region: 'us-east-1' })
// after
const s3 = new S3mini({
  endpoint: 'https://s3.us-east-1.amazonaws.com',
  accessKeyId,
  secretAccessKey,
  region: 'us-east-1',
})

const cfg = { endpoint: process.env.S3_ENDPOINT, accessKeyId, secretAccessKey }
if (!cfg.endpoint || !/^https?:\/\//.test(cfg.endpoint)) {
  throw new Error('S3 endpoint must be set to a http(s) URL when using static credentials')
}
const s3 = new S3mini(cfg)

When it happens

Trigger: Constructing `new S3mini({ accessKeyId, secretAccessKey, ... })` (or otherwise enabling credential-based signing, e.g. additionalSigners) without an `endpoint` option; endpoint is null/undefined/empty at signing time.

Common situations: Migrating from a version where endpoint was optional or defaulted (e.g. derived from bucket/region); passing only `region` + credentials expecting an AWS URL to be synthesized; typos like `endPoint` or `host`; using a custom S3-compatible backend but forgetting its URL.

Related errors

• getCredentials must be a function
• [s3mini] endpoint must be a valid URL. Expected format: http
• Either signRequest or getCredentials must be provided
• signRequest must be a function
• [s3mini] endpoint must be a non-empty string

AI-assisted analysis of transloadit/uppy@5d4dedd02a (2026-08-28). Data as JSON: /api/errors/882c57d6f6f245af. Report an issue: GitHub.