{"record":{"id":"32f68d966d0f8042","repo":"crowdsecurity/crowdsec","slug":"missing-token-value-for-api-server-auto-register","errorCode":null,"errorMessage":"missing token value for api.server.auto_register","messagePattern":"missing token value for api\\.server\\.auto_register","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csconfig/api.go","lineNumber":539,"sourceCode":"\tif c.AutoRegister == nil {\n\t\tc.AutoRegister = &LocalAPIAutoRegisterCfg{\n\t\t\tEnable: new(false),\n\t\t}\n\n\t\treturn nil\n\t}\n\n\t// Disable by default\n\tif c.AutoRegister.Enable == nil {\n\t\tc.AutoRegister.Enable = new(false)\n\t}\n\n\tif !*c.AutoRegister.Enable {\n\t\treturn nil\n\t}\n\n\tif c.AutoRegister.Token == \"\" {\n\t\treturn errors.New(\"missing token value for api.server.auto_register\")\n\t}\n\n\tif len(c.AutoRegister.Token) < 32 {\n\t\treturn errors.New(\"token value for api.server.auto_register is too short (min 32 characters)\")\n\t}\n\n\tif c.AutoRegister.AllowedRanges == nil {\n\t\treturn errors.New(\"missing allowed_ranges value for api.server.auto_register\")\n\t}\n\n\tc.AutoRegister.AllowedRangesParsed = make([]*net.IPNet, 0, len(c.AutoRegister.AllowedRanges))\n\n\tfor _, ipRange := range c.AutoRegister.AllowedRanges {\n\t\t_, ipNet, err := net.ParseCIDR(ipRange)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"auto_register: failed to parse allowed range '%s': %w\", ipRange, err)\n\t\t}\n","sourceCodeStart":521,"sourceCodeEnd":557,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csconfig/api.go#L521-L557","documentation":"LoadAutoRegister validates the api.server.auto_register feature, which lets the LAPI auto-enroll agents. When auto_register is enabled, a registration token is mandatory; a missing token aborts config loading.","triggerScenarios":"api.server.auto_register.enable: true with no api.server.auto_register.token set (empty string); LocalApiServerCfg.LoadAutoRegister() during LAPI config load.","commonSituations":"Enabling auto_register in a Helm chart or config template that omits the token; copying an auto_register block from docs without filling in the token; forgetting the token after upgrading to a version that introduced auto_register.","solutions":["Generate a token (32+ chars) and set it under api.server.auto_register.token","Set api.server.auto_register.enable: false if auto-enrollment is not wanted","Render the token via secret management in templated deployments"],"exampleFix":"// before\napi:\n  server:\n    auto_register:\n      enable: true\n// after\napi:\n  server:\n    auto_register:\n      enable: true\n      token: \"0123456789abcdef0123456789abcdef\"","handlingStrategy":"validation","validationCode":"if cfg.AutoRegister != nil && cfg.AutoRegister.Enable != nil && *cfg.AutoRegister.Enable && cfg.AutoRegister.Token == \"\" {\n    return errors.New(\"auto_register enabled without token\")\n}","typeGuard":null,"tryCatchPattern":"if err := serverCfg.LoadAutoRegister(); err != nil {\n    return fmt.Errorf(\"auto_register config: %w\", err)\n}","preventionTips":["Generate tokens with `openssl rand -hex 16` and store them in secret managers","Never enable auto_register in templates without a token field","Validate rendered configs in CI before rollout"],"tags":["go","config","lapi","auto-register"],"backgroundTag":"missing-required-config-field","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}