tursodatabase/turso · error · ArgumentException

Use AuthToken instead of embedding credentials in the sync U

Error message

Use AuthToken instead of embedding credentials in the sync URL.

What it means

GetNormalizedRemoteUri rejects a RemoteUri containing user information (user:password@ in the URL). Credentials embedded in the sync URL are a security risk and get stripped or mishandled by normalization, so the library refuses them and directs you to the dedicated AuthToken option.

Source

Thrown at bindings/dotnet/src/Turso.Data/TursoSyncDatabaseOptions.cs:130

    public string ClientName { get; init; } = "turso-sync-dotnet";
    public TimeSpan? LongPollTimeout { get; init; }
    public bool BootstrapIfEmpty { get; init; } = true;
    public TursoPartialSyncOptions? PartialSync { get; init; }
    public TursoRemoteEncryptionOptions? RemoteEncryption { get; init; }
    public long? PushOperationsThreshold { get; init; }
    public long? PullBytesThreshold { get; init; }
    public bool ForceLogicalMvccPull { get; init; }
    public HttpClient? HttpClient { get; init; }
    public string? ExperimentalFeatures { get; init; }

    internal Uri GetNormalizedRemoteUri()
    {
        if (!RemoteUri.IsAbsoluteUri)
            throw new ArgumentException("The sync remote URL must be absolute.", nameof(RemoteUri));
        if (!string.IsNullOrEmpty(RemoteUri.Query) || !string.IsNullOrEmpty(RemoteUri.Fragment))
            throw new ArgumentException("The sync remote URL must not include a query string or fragment.", nameof(RemoteUri));
        if (!string.IsNullOrEmpty(RemoteUri.UserInfo))
            throw new ArgumentException("Use AuthToken instead of embedding credentials in the sync URL.", nameof(RemoteUri));
        if (string.IsNullOrEmpty(RemoteUri.Host))
            throw new ArgumentException("The sync remote URL must include a host.", nameof(RemoteUri));

        var scheme = RemoteUri.Scheme.ToLowerInvariant() switch
        {
            "turso" or "libsql" => Uri.UriSchemeHttps,
            "http" => Uri.UriSchemeHttp,
            "https" => Uri.UriSchemeHttps,
            _ => throw new ArgumentException(
                "The sync remote URL must use turso, libsql, HTTP, or HTTPS.",
                nameof(RemoteUri)),
        };
        var builder = new UriBuilder(RemoteUri)
        {
            Scheme = scheme,
            Port = RemoteUri.IsDefaultPort ? -1 : RemoteUri.Port,
            UserName = string.Empty,
            Password = string.Empty,

View on GitHub (pinned to c1e5928725)

Solutions

1. Remove the user:password@ section from the remote URL.
2. Pass the credential via the AuthToken property of TursoSyncDatabaseOptions instead.

Example fix

// before
var opts = new TursoSyncDatabaseOptions(path, new Uri("https://admin:secret@mydb.turso.io"));
// after
var opts = new TursoSyncDatabaseOptions(path, new Uri("https://mydb.turso.io")) { AuthToken = "secret" };

static void EnsureNoEmbeddedCredentials(Uri remoteUri)
{
    if (!string.IsNullOrEmpty(remoteUri.UserInfo))
        throw new ArgumentException("Move user:password@ from the sync URL into AuthToken.");
}

static bool HasNoUrlCredentials(Uri u) => string.IsNullOrEmpty(u.UserInfo);

try { var db = new TursoSyncDatabase(opts); }
catch (ArgumentException ex) when (ex.Message.Contains("AuthToken"))
{
    // rebuild options with AuthToken instead of URL credentials
}

When it happens

Trigger: Constructing TursoSyncDatabaseOptions with a RemoteUri like https://user:token@mydb.turso.io or libsql://admin:secret@host. Uri.UserInfo is non-empty at TursoSyncDatabaseOptions.cs:129-130.

Common situations: Converting libsql clients that used user:pass basic auth in URLs, pasting connection strings from other databases (Postgres/MySQL style user:password@host), reusing a URL configured for a driver that supported in-URL credentials.

Related errors

• The sync remote URL must not include a query string or fragm
• The sync remote URL must include a host.
• The sync remote URL must use turso, libsql, HTTP, or HTTPS.
• Auth Token requires an HTTPS sync URL unless the host is loc
• Remote Turso URLs must not include embedded user information

AI-assisted analysis of tursodatabase/turso@c1e5928725 (2026-08-31). Data as JSON: /api/errors/34bca22a05f35d34. Report an issue: GitHub.