How to fix CR_AUTH_PLUGIN_ERR (2061): Authentication plugin reported error in MySQL

Connect to MySQL as an administrator and verify which authentication plugin is assigned to your user:

SELECT User, Host, plugin FROM mysql.user WHERE User = 'your_username';

Note the plugin name. If it shows caching_sha2_password or sha256_password, you've found the cause.

Alter the user to use the older, widely-supported mysql_native_password authentication method. This is the fastest way to restore connectivity:

ALTER USER 'your_username'@'your_host' IDENTIFIED WITH mysql_native_password BY 'your_password';
FLUSH PRIVILEGES;

Replace your_username and your_host with the actual user and host. The host is often localhost for local connections or % for remote access. After running this, your client should connect successfully.

If you want to keep caching_sha2_password (more secure), establish an SSL/TLS connection to MySQL. This allows the plugin to transmit the password safely without RSA encryption fallback:

For mysql CLI:

mysql --ssl-mode=REQUIRED -u your_username -h your_host -p

For Node.js with mysql2/promise:

const connection = await mysql.createConnection({
  host: 'your_host',
  user: 'your_username',
  password: 'your_password',
  database: 'your_database',
  ssl: 'amazon', // or true, or path to CA cert
});

For other languages: Configure your database driver to use SSL (consult your library's documentation).

If you cannot use SSL, request the server to send its RSA public key so the client can encrypt the password:

For mysql CLI:

mysql --ssl-mode=DISABLED -u your_username -h your_host -p --get-server-public-key

For Node.js with mysql2/promise:

const connection = await mysql.createConnection({
  host: 'your_host',
  user: 'your_username',
  password: 'your_password',
  database: 'your_database',
  getServerPublicKey: true,
});

This is less secure than SSL/TLS but allows the plugin to complete password exchange.

If you control the MySQL server and want to use mysql_native_password globally (not recommended for production, but useful for development), edit the MySQL configuration file:

On Linux/macOS:
Edit /etc/mysql/my.cnf or /usr/local/etc/my.cnf

On Windows:
Edit C:\\ProgramData\\MySQL\\MySQL Server 8.0\\my.ini

Add this under the [mysqld] section:

[mysqld]
default_authentication_plugin=mysql_native_password

Save and restart MySQL:

# Linux
sudo systemctl restart mysql

# macOS
brew services restart mysql

# Windows (command prompt as admin)
net stop MySQL80
net start MySQL80

New user accounts will now use mysql_native_password by default.

Test the connection with your database client:

mysql -u your_username -h your_host -p -e "SELECT 1;"

If you see "1" in the output, the connection is successful. For application-level connections (Node.js, Python, PHP, etc.), test with a simple query to confirm the database is accessible.