# "bad auth : Authentication failed" (code 18)
Full text looks like: `MongoServerError: bad auth : Authentication failed.` This is always credentials, never the network. If the network were the problem you would see a timeout instead.
## Confirm in order
1. The user exists: Atlas UI, Security, Database Access. Look for the exact username. A typo here is the most common cause.
2. The password is current. If it was rotated, every stored connection string is stale.
3. The auth source is right. Atlas users authenticate against the `admin` database. If your string has no `authSource=admin` and the URI path names a different database, the driver may try the wrong one. Add `authSource=admin` explicitly.
4. The password has no unencoded special characters. `@`, `/`, `:` and friends in the password break URI parsing and produce exactly this error. URL-encode the password.
## Fix
Correct the piece that is wrong, update the stored secret, and re-run the startup ping. Do not "fix" it by widening the IP access list or recreating the cluster.
## Verify
`mongosh` with the same string succeeds. If mongosh works and the app fails, the app is mangling the string (bad env substitution, truncated secret).