{"record":{"id":"5bbf8d61a00b6ab8","repo":"crowdsecurity/crowdsec","slug":"invalid-api-key","errorCode":null,"errorMessage":"invalid API key","messagePattern":"invalid API key","errorType":"error_code","errorClass":"errInvalidAPIKey","httpStatus":401,"severity":"error","filePath":"pkg/acquisition/modules/appsec/config.go","lineNumber":32,"sourceCode":"\n\tyaml \"github.com/goccy/go-yaml\"\n\t\"github.com/google/uuid\"\n\t\"github.com/prometheus/client_golang/prometheus\"\n\tlog \"github.com/sirupsen/logrus\"\n\n\t\"github.com/crowdsecurity/crowdsec/pkg/acquisition/configuration\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/apiclient/useragent\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/appsec\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/appsec/allowlists\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/appsec/challenge\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/cwhub\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/exprhelpers\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/metrics\"\n)\n\nvar (\n\terrMissingAPIKey = errors.New(\"missing API key\")\n\terrInvalidAPIKey = errors.New(\"invalid API key\")\n)\n\nvar (\n\tDefaultAuthCacheDuration = (1 * time.Minute)\n\tDefaultAuthTimeout       = (200 * time.Millisecond)\n\tDefaultBodyReadTimeout   = (1 * time.Second)\n)\n\n// configuration structure of the acquis for the application security engine\ntype Configuration struct {\n\tListenAddr        string         `yaml:\"listen_addr\"`\n\tListenSocket      string         `yaml:\"listen_socket\"`\n\tCertFilePath      string         `yaml:\"cert_file\"`\n\tKeyFilePath       string         `yaml:\"key_file\"`\n\tPath              string         `yaml:\"path\"`\n\tRoutines          int            `yaml:\"routines\"`\n\tAppsecConfig      string         `yaml:\"appsec_config\"`\n\tAppsecConfigs     []string       `yaml:\"appsec_configs\"`","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/appsec/config.go#L14-L50","documentation":"Sentinel error errInvalidAPIKey returned by Source.checkAuth in two cases: (1) LAPI could not vouch for the key and it is not in the local auth cache, or (2) LAPI explicitly answered that the key is not authorized, in which case the cached entry is evicted with AuthCache.Delete. It means the presented API key exists syntactically but failed authentication against LAPI.","triggerScenarios":"Thrown at pkg/acquisition/modules/appsec/config.go:32 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the API key matches one registered in LAPI (cscli bouncers list / agents list); regenerate if needed","Check clocks and TLS between the appsec component and LAPI — an LAPI outage with a cold auth cache also surfaces as this error","If the key was recently revoked, restart or reconfigure the component with a valid key; the cache entry is evicted on rejection"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}