{"record":{"id":"09a5810943949297","repo":"grafana/k6","slug":"cloud-secrets-not-configured-endpoint-not-set","errorCode":null,"errorMessage":"cloud secrets not configured: endpoint not set","messagePattern":"cloud secrets not configured: endpoint not set","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/secretsource/cloud/cloud.go","lineNumber":119,"sourceCode":"\t}\n\n\t// (Re-)initialize for the new config.\n\tcs.activeCfg = current\n\tcs.urlSource = nil\n\tcs.initErr = nil\n\n\tif current == nil {\n\t\tcs.initErr = cs.notConfiguredError()\n\t\treturn nil, cs.initErr\n\t}\n\n\tif current.Token == \"\" {\n\t\tcs.initErr = errors.New(\"cloud secrets not configured: token not set\")\n\t\treturn nil, cs.initErr\n\t}\n\n\tif current.Endpoint == \"\" {\n\t\tcs.initErr = errors.New(\"cloud secrets not configured: endpoint not set\")\n\t\treturn nil, cs.initErr\n\t}\n\n\textra := 2 // always: URL template + Authorization header\n\tif current.ResponsePath != \"\" {\n\t\textra = 3\n\t}\n\tenvCopy := make(map[string]string, len(cs.params.Environment)+extra)\n\tmaps.Copy(envCopy, cs.params.Environment)\n\tenvCopy[\"K6_SECRET_SOURCE_URL_URL_TEMPLATE\"] = current.Endpoint\n\tenvCopy[\"K6_SECRET_SOURCE_URL_HEADER_AUTHORIZATION\"] = \"Bearer \" + current.Token\n\tif current.ResponsePath != \"\" {\n\t\tenvCopy[\"K6_SECRET_SOURCE_URL_RESPONSE_PATH\"] = current.ResponsePath\n\t}\n\n\tp := cs.params\n\tp.Environment = envCopy\n\tcs.urlSource, cs.initErr = url.New(p)","sourceCodeStart":101,"sourceCodeEnd":137,"githubUrl":"https://github.com/grafana/k6/blob/93accf6570dcd306ca5e99cc44c393ee3797761b/internal/secretsource/cloud/cloud.go#L101-L137","documentation":"Returned while initializing the cloud secrets URL source when a secrets configuration has a Token but its Endpoint is empty. The endpoint becomes the URL template (envCopy[\"K6_SECRET_SOURCE_URL_URL_TEMPLATE\"]) used to fetch each secret, so without it the URL source cannot be constructed at all.","triggerScenarios":"K6_CLOUD_SECRETS_TOKEN set without K6_CLOUD_SECRETS_ENDPOINT; a partially-injected secrets config in the environment; the endpoint env var name misspelled (e.g. K6_CLOUD_SECRETS_URL) so it resolves to unset.","commonSituations":"Credential-first provisioning scripts that set the token but derive the endpoint from a variable that failed to expand; environments split across multiple env files where only one was sourced; documentation drift on the exact env var name.","solutions":["Set K6_CLOUD_SECRETS_ENDPOINT (together with the token), e.g. https://cloudapi.k6.io/v1/secrets","Double-check the exact variable spelling against the docs: K6_CLOUD_SECRETS_ENDPOINT","Source all relevant env files in the same shell/CI step that launches k6"],"exampleFix":"# before\nexport K6_CLOUD_SECRETS_TOKEN=$CLOUD_TOKEN\n# endpoint missing -> error\n\n# after\nexport K6_CLOUD_SECRETS_TOKEN=$CLOUD_TOKEN\nexport K6_CLOUD_SECRETS_ENDPOINT=https://cloudapi.k6.io/v1/secrets","handlingStrategy":"validation","validationCode":"[ -n \"${K6_CLOUD_SECRETS_ENDPOINT:-}\" ] || { echo 'K6_CLOUD_SECRETS_ENDPOINT is empty'; exit 1; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Set token and endpoint in one env block so they are never split","Pin the endpoint per environment in a single sourced file","Check exact spelling: K6_CLOUD_SECRETS_ENDPOINT (not _URL)"],"tags":["k6","cloud","secrets","endpoint","env-vars"],"backgroundTag":null,"analyzedSha":"93accf6570dcd306ca5e99cc44c393ee3797761b","analyzedAt":"2026-08-15T21:23:27.118Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}