{"record":{"id":"4be6d79be7e700aa","repo":"grafana/k6","slug":"token-is-required-to-create-provisioning-api-clien","errorCode":null,"errorMessage":"token is required to create provisioning API client","messagePattern":"token is required to create provisioning API client","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/cloudapi/provisioning/client.go","lineNumber":47,"sourceCode":"\tstackID   int64\n\thost      string\n\tversion   string\n\n\tlogger logrus.FieldLogger\n}\n\n// NewClient returns a new provisioning Client. It internally constructs\n// both a k6cloud.APIClient (for provisioning endpoints) and a v6.Client\n// (for v6 operations like FetchTest). The stackID identifies the\n// Grafana Cloud stack and is required for the stack-scoped requests.\nfunc NewClient(\n\tlogger logrus.FieldLogger,\n\ttoken, host, version string,\n\tstackID int64,\n\ttimeout time.Duration,\n) (*Client, error) {\n\tif token == \"\" {\n\t\treturn nil, fmt.Errorf(\"token is required to create provisioning API client\")\n\t}\n\n\tcfg := clientcfg.New(host, version, \"k6 Cloud API (provisioning).\", timeout)\n\n\tv6c, err := v6.NewClient(logger, token, host, version, timeout)\n\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"creating v6 client: %w\", err)\n\t}\n\n\tc := &Client{\n\t\tapiClient: k6cloud.NewAPIClient(cfg),\n\t\tv6Client:  v6c,\n\t\ttoken:     token,\n\t\tstackID:   stackID,\n\t\thost:      host,\n\t\tversion:   version,\n\t\tlogger:    logger,\n\t}","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/grafana/k6/blob/8d06114777191d21ef885d05c5f8aa9e1ed838ae/internal/cloudapi/provisioning/client.go#L29-L65","documentation":"Returned by provisioning.NewClient (internal/cloudapi/provisioning/client.go:47) when the token argument is an empty string — the client refuses to construct without cloud API credentials because every subsequent call would fail with opaque 401s. The token is the k6 Cloud / Grafana Cloud k6 API token normally supplied via K6_CLOUD_TOKEN or k6 cloud login. Failing here is intentional and the earliest possible point to catch a missing credential.","triggerScenarios":"Calling NewClient with token == \"\": environment variable K6_CLOUD_TOKEN unset or empty in the shell/CI, 'k6 cloud login' never run or its stored token cleared, or an explicit empty-string token passed programmatically.","commonSituations":"CI pipelines where the secret name is misspelled (K6_CLOUD_TOKEN vs K6_CLOUD_API_TOKEN) or the secret scoped to another environment; fresh machines/clones without cloud login; scripts reading the token from a config file that has an empty field.","solutions":["Set the token: export K6_CLOUD_TOKEN=<token> or run 'k6 cloud login' (or 'k6 cloud login --token <token>' non-interactively).","In CI, verify the secret variable name and that it is exposed to the step (print ${#K6_CLOUD_TOKEN} to check length without leaking it).","If constructing the client in Go, resolve and validate the token before calling NewClient (see defense code).","Create a token in Grafana Cloud (k6 plugin → API tokens) with sufficient scope if none exists."],"exampleFix":"// before\nc, err := provisioning.NewClient(logger, os.Getenv(\"K6_CLOUD_TOKEN\"), host, version, stackID, timeout)\n\n// after — validate before constructing, with an actionable message\ntoken := os.Getenv(\"K6_CLOUD_TOKEN\")\nif token == \"\" {\n\treturn nil, errors.New(\"K6_CLOUD_TOKEN is not set; run 'k6 cloud login' or export it in CI\")\n}\nc, err := provisioning.NewClient(logger, token, host, version, stackID, timeout)","handlingStrategy":"validation","validationCode":"token := strings.TrimSpace(os.Getenv(\"K6_CLOUD_TOKEN\"))\nif token == \"\" {\n\treturn nil, errors.New(\"K6_CLOUD_TOKEN not set — run 'k6 cloud login' or define it in CI secrets\")\n}\nc, err := provisioning.NewClient(logger, token, host, version, stackID, timeout)","typeGuard":null,"tryCatchPattern":"if _, err := provisioning.NewClient(logger, token, host, version, stackID, timeout); err != nil {\n\tif strings.Contains(err.Error(), \"token is required\") {\n\t\t// credential bootstrap problem: guide user to login; do not retry\n\t\tos.Stderr.WriteString(\"Missing k6 Cloud token. Run: k6 cloud login\\n\")\n\t}\n\treturn err\n}","preventionTips":["Run 'k6 cloud login' on developer machines and persist it in CI as K6_CLOUD_TOKEN.","Verify secret names and scoping in CI before the job starts (check length, not value).","Fail fast in wrappers/scripts on an empty token instead of letting the client construct fail."],"tags":["k6","cloud","provisioning","authentication","api-token","missing-credential"],"backgroundTag":"missing-api-token","analyzedSha":"8d06114777191d21ef885d05c5f8aa9e1ed838ae","analyzedAt":"2026-08-18T03:05:52.393Z","contentChangedAt":"2026-08-18T03:05:52.393Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}