{"record":{"id":"81318c5bc8b4e055","repo":"crowdsecurity/crowdsec","slug":"authenticate-watcher-s-w-81318c","errorCode":null,"errorMessage":"authenticate watcher (%s): %w","messagePattern":"authenticate watcher \\((.+?)\\): %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/apiserver/apic.go","lineNumber":281,"sourceCode":"\t\treturn nil\n\t}\n\n\tlog.WithError(err).Debug(\"No useful token, authenticating\")\n\n\tscenarios, err := a.FetchScenariosListFromDB(ctx)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"get scenario in db: %w\", err)\n\t}\n\n\tpassword := strfmt.Password(config.Credentials.Password)\n\n\tauthResp, _, err := a.apiClient.Auth.AuthenticateWatcher(ctx, models.WatcherAuthRequest{\n\t\tMachineID: &config.Credentials.Login,\n\t\tPassword:  &password,\n\t\tScenarios: scenarios,\n\t})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"authenticate watcher (%s): %w\", config.Credentials.Login, err)\n\t}\n\n\tif err = transport.Expiration.UnmarshalText([]byte(authResp.Expire)); err != nil {\n\t\treturn fmt.Errorf(\"unable to parse jwt expiration: %w\", err)\n\t}\n\n\ttransport.Token = authResp.Token\n\n\treturn a.dbClient.SaveAPICToken(ctx, authResp.Token)\n}\n\n// keep track of all alerts in cache and push it to CAPI every PushInterval.\nfunc (a *apic) Push(ctx context.Context) error {\n\tvar cache modelscapi.AddSignalsRequest\n\n\tticker := time.NewTicker(a.pushIntervalFirst)\n\n\tlog.Infof(\"Start push to CrowdSec Central API (interval: %s once, then %s)\", a.pushIntervalFirst.Round(time.Second), a.pushInterval)","sourceCodeStart":263,"sourceCodeEnd":299,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/apiserver/apic.go#L263-L299","documentation":"The watcher (crowdsec agent) failed to authenticate against the Central API (CAPI) with the given login. The CAPI rejected the credentials, the machine is not yet validated, or the API endpoint was unreachable/misconfigured. Includes the login name so the offending machine identity is identifiable in enrollment logs.","triggerScenarios":"Thrown at pkg/apiserver/apic.go:281 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Verify the credentials in the online API credentials file match a registered CAPI machine","Check that the machine is validated: `cscli capi status` and re-register with `cscli capi register` if needed","Confirm network access and URL of the Central API — proxies, TLS interception or DNS failures surface here","Check CAPI-side status and retry later if the Central API returned a transient 5xx"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}