{"record":{"id":"558d81f3b4fac37a","repo":"crowdsecurity/crowdsec","slug":"loading-online-client-credentials-w","errorCode":null,"errorMessage":"loading online client credentials: %w","messagePattern":"loading online client credentials: %w","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/csconfig/api.go","lineNumber":374,"sourceCode":"\t}\n\n\tif !*c.API.Server.Enable {\n\t\tlog.Warning(\"crowdsec local API is disabled because 'enable' is set to false\")\n\n\t\tc.DisableAPI = true\n\t}\n\n\tif c.DisableAPI {\n\t\treturn nil\n\t}\n\n\tif c.API.Server.ListenURI == \"\" && c.API.Server.ListenSocket == \"\" {\n\t\treturn errors.New(\"no listen_uri or listen_socket specified\")\n\t}\n\n\tif c.API.Server.OnlineClient != nil && c.API.Server.OnlineClient.CredentialsFilePath != \"\" && !skipOnlineCreds {\n\t\tif err := c.API.Server.OnlineClient.Load(); err != nil {\n\t\t\treturn fmt.Errorf(\"loading online client credentials: %w\", err)\n\t\t}\n\t}\n\n\tif (c.API.Server.OnlineClient == nil || c.API.Server.OnlineClient.Credentials == nil) && !inCli {\n\t\tlog.Info(\"push and pull to Central API disabled\")\n\t}\n\n\t// Set default values for CAPI push/pull\n\tif c.API.Server.OnlineClient != nil {\n\t\tif c.API.Server.OnlineClient.PullConfig.Community == nil {\n\t\t\tc.API.Server.OnlineClient.PullConfig.Community = new(true)\n\t\t}\n\n\t\tif c.API.Server.OnlineClient.PullConfig.Blocklists == nil {\n\t\t\tc.API.Server.OnlineClient.PullConfig.Blocklists = new(true)\n\t\t}\n\n\t\tif c.API.Server.OnlineClient.Sharing == nil {","sourceCodeStart":356,"sourceCodeEnd":392,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/csconfig/api.go#L356-L392","documentation":"LoadAPIServer validates the LAPI server config and, when an OnlineClient (Central API / enrollment) credentials file is configured, loads it via OnlineClient.Load(). Any error from that load — parse failure, missing URL/credentials, unreadable CA cert or client pair — is wrapped with this prefix. It chains errors 765-768 into the server startup path.","triggerScenarios":"Config has api.server.online_client.credentials_path set (and skipOnlineCreds is false) and the underlying Load() returns any of: YAML parse error, no credentials/URL in the file, failed CA cert load, or failed client certificate load.","commonSituations":"crowdsec enrolled once then the CAPI credentials file was deleted or corrupted; config YAML references online_client after `cscli capi unregister` removed the credentials; automated provisioning writes the credentials file after the service starts; wrong credentials_path in config.yaml.","solutions":["Read the wrapped inner error to find the real cause, then fix the CAPI credentials file at the path given in api.server.online_client.credentials_path.","Re-enroll: `cscli capi register && cscli capi enable` (or `cscli console enroll <key>`) to regenerate valid credentials.","If the machine should not talk to Central API, remove the online_client section (or its credentials_path) from config.yaml — the server then just logs 'push and pull to Central API disabled'.","Pass skipOnlineCreds where the codebase allows it (e.g. some CLI paths) if credentials should not block startup.","Check that the credentials file is readable by the crowdsec service user."],"exampleFix":"# before (config.yaml): stale online_client credentials_path\napi:\n  server:\n    online_client:\n      credentials_path: /etc/crowdsec/capi_credentials.yaml  # file deleted\n# after: drop the block to disable CAPI, or re-enroll to recreate the file\napi:\n  server:\n    online_client: ~","handlingStrategy":"try-catch","validationCode":"if cfg.API.Server.OnlineClient != nil && cfg.API.Server.OnlineClient.CredentialsFilePath != \"\" {\n    if _, err := os.Stat(cfg.API.Server.OnlineClient.CredentialsFilePath); err != nil {\n        log.Warningf(\"CAPI credentials missing at %s; CAPI push/pull disabled\", cfg.API.Server.OnlineClient.CredentialsFilePath)\n    }\n}","typeGuard":null,"tryCatchPattern":"if err := cfg.LoadAPIServer(); err != nil {\n    if strings.Contains(err.Error(), \"loading online client credentials\") {\n        // degrade gracefully: disable CAPI instead of failing startup\n        log.Warning(\"CAPI credentials unusable, continuing without Central API\")\n    } else {\n        return err\n    }\n}","preventionTips":["Enroll machines before enabling crowdsec service, or remove online_client when not enrolled.","Provision CAPI credentials before the service's first start (init container / pre-start hook).","After `cscli capi unregister`, also clean up the online_client config block.","Monitor startup logs for this wrapper to catch corrupt CAPI credentials early."],"tags":["config","startup","crowdsec"],"backgroundTag":"missing-required-config","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}