{"record":{"id":"4d4cba3dfb9221f4","repo":"crowdsecurity/crowdsec","slug":"token-not-found-in-db","errorCode":null,"errorMessage":"token not found in DB","messagePattern":"token not found in DB","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"warning","filePath":"pkg/database/token.go","lineNumber":16,"sourceCode":"package database\n\nimport (\n\t\"context\"\n\t\"errors\"\n\t\"fmt\"\n\t\"time\"\n\n\t\"github.com/golang-jwt/jwt/v4\"\n\t\"github.com/sirupsen/logrus\"\n)\n\nconst APICTokenKey = \"apic_token\"\n\nvar (\n\tErrTokenNotFound     = errors.New(\"token not found in DB\")\n\tErrTokenParse        = errors.New(\"unable to parse token\")\n\tErrTokenMissingClaim = errors.New(\"token missing required claim\")\n\tErrTokenExpired      = errors.New(\"token expired\")\n)\n\ntype APICToken struct {\n\tRaw       string\n\tExpiresAt time.Time\n}\n\n// LoadAPICToken attempts to retrieve and validate a JWT token from the local database.\n// Errors are returned if the token can't be read, is not valid, expired or has no expiration.\nfunc (c *Client) LoadAPICToken(ctx context.Context, logger logrus.FieldLogger) (APICToken, error) {\n\ttoken, err := c.GetConfigItem(ctx, APICTokenKey) // TokenKey is a constant string representing the key for the token in the database\n\tif err != nil {\n\t\treturn APICToken{}, fmt.Errorf(\"loading token: %w\", err)\n\t}\n","sourceCodeStart":1,"sourceCodeEnd":34,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/database/token.go#L1-L34","documentation":"LoadAPICToken fetches the CAPI (community blocklist) JWT from the local DB. ErrTokenNotFound is a sentinel returned when the stored apic_token value is empty or absent, meaning this instance has never received/persisted a token. It is designed for errors.Is checks so callers can trigger re-enrollment.","triggerScenarios":"Calling LoadAPICToken before the instance is enrolled with CAPI, or after the token row was deleted/flushed from the DB.","commonSituations":"Fresh crowdsec install not yet enrolled (cscli capi enroll not run), token wiped by DB flush, testing without internet/enrollment.","solutions":["Enroll the instance: cscli capi enroll <enroll_key>","Ignore the error if unenrolled operation is expected (check with errors.Is(ErrTokenNotFound))","Re-run enrollment to repopulate the apic_token row"],"exampleFix":"tok, err := client.LoadAPICToken(ctx)\nif errors.Is(err, dbclient.ErrTokenNotFound) {\n    // not enrolled yet, skip CAPI pull\n    return nil\n}","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"tok, err := client.LoadAPICToken(ctx)\nif errors.Is(err, dbclient.ErrTokenNotFound) {\n    // not enrolled: skip CAPI pull or trigger enrollment\n    return nil\n}\nif err != nil {\n    return err\n}","preventionTips":["Enroll the instance at setup time (cscli capi enroll)","Check enrollment status before pulling CAPI data","Use errors.Is against the exported sentinel, not string matching"],"tags":["jwt","database","capi","crowdsec"],"backgroundTag":"record-not-found","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}