{"record":{"id":"341848b774435e4e","repo":"windmill-labs/windmill","slug":"could-not-resolve-credentials-for-workspace-ws","errorCode":null,"errorMessage":"Could not resolve credentials for workspace '${ws}'. Either pass --base-url and --token, or ensure wmill.yaml workspaces.${ws} has a baseUrl and you've run 'wmill workspace add' for it.","messagePattern":"Could not resolve credentials for workspace '(.+?)'\\. Either pass --base-url and --token, or ensure wmill\\.yaml workspaces\\.(.+?) has a baseUrl and you've run 'wmill workspace add' for it\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cli/src/commands/protection-rules/file.ts","lineNumber":120,"sourceCode":"): Promise<string> {\n  const wsId = resolver.backendId(ws); // throws if not in wmill.yaml\n\n  // 1. Explicit credentials — honor them directly, like other commands do.\n  if (opts.baseUrl) {\n    if (!opts.token) {\n      throw new Error(\n        \"When --base-url is set, --token is required for protection-rules.\",\n      );\n    }\n    setClient(opts.token, opts.baseUrl.replace(/\\/+$/, \"\"));\n    return wsId;\n  }\n\n  // 2. Stored-profile resolution. Fresh opts so resolveWorkspace's per-call\n  // cache can't bleed across keys.\n  const resolved = await tryResolveBranchWorkspace({ ...opts }, ws);\n  if (!resolved) {\n    throw new Error(\n      `Could not resolve credentials for workspace '${ws}'. Either pass ` +\n        `--base-url and --token, or ensure wmill.yaml workspaces.${ws} has a ` +\n        `baseUrl and you've run 'wmill workspace add' for it.`,\n    );\n  }\n  // An explicit --token overrides the stored profile's token.\n  setClient(opts.token ?? resolved.token, resolved.remote.replace(/\\/+$/, \"\"));\n  return wsId;\n}\n","sourceCodeStart":102,"sourceCodeEnd":130,"githubUrl":"https://github.com/windmill-labs/windmill/blob/e474e8803ce2ff5c2df09a58dab51d45f5c922ca/cli/src/commands/protection-rules/file.ts#L102-L130","documentation":"Error \"Could not resolve credentials for workspace '${ws}'. Either pass --base-url and --token, or ensure wmill.yaml workspaces.${ws} has a baseUrl and you've run 'wmill workspace add' for it.\" thrown in windmill-labs/windmill.","triggerScenarios":"Thrown at cli/src/commands/protection-rules/file.ts:120 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Pass explicit --base-url and --token together for stateless/CI use","Ensure wmill.yaml workspaces.<ws> declares the workspace's baseUrl and run 'wmill workspace add' for it to store a profile token","Re-login (wmill login) if the stored token expired, then retry the protection-rules command"],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"e474e8803ce2ff5c2df09a58dab51d45f5c922ca","analyzedAt":"2026-09-03T12:38:19.024Z","contentChangedAt":"2026-09-03T12:38:19.024Z","schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}