{"record":{"id":"e94112e9c48dc0d7","repo":"crowdsecurity/crowdsec","slug":"missing-api-key","errorCode":null,"errorMessage":"missing API key","messagePattern":"missing API key","errorType":"error_code","errorClass":"errMissingAPIKey","httpStatus":401,"severity":"error","filePath":"pkg/acquisition/modules/appsec/config.go","lineNumber":31,"sourceCode":"\t\"time\"\n\n\tyaml \"github.com/goccy/go-yaml\"\n\t\"github.com/google/uuid\"\n\t\"github.com/prometheus/client_golang/prometheus\"\n\tlog \"github.com/sirupsen/logrus\"\n\n\t\"github.com/crowdsecurity/crowdsec/pkg/acquisition/configuration\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/apiclient/useragent\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/appsec\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/appsec/allowlists\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/appsec/challenge\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/cwhub\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/exprhelpers\"\n\t\"github.com/crowdsecurity/crowdsec/pkg/metrics\"\n)\n\nvar (\n\terrMissingAPIKey = errors.New(\"missing API key\")\n\terrInvalidAPIKey = errors.New(\"invalid API key\")\n)\n\nvar (\n\tDefaultAuthCacheDuration = (1 * time.Minute)\n\tDefaultAuthTimeout       = (200 * time.Millisecond)\n\tDefaultBodyReadTimeout   = (1 * time.Second)\n)\n\n// configuration structure of the acquis for the application security engine\ntype Configuration struct {\n\tListenAddr        string         `yaml:\"listen_addr\"`\n\tListenSocket      string         `yaml:\"listen_socket\"`\n\tCertFilePath      string         `yaml:\"cert_file\"`\n\tKeyFilePath       string         `yaml:\"key_file\"`\n\tPath              string         `yaml:\"path\"`\n\tRoutines          int            `yaml:\"routines\"`\n\tAppsecConfig      string         `yaml:\"appsec_config\"`","sourceCodeStart":13,"sourceCodeEnd":49,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/acquisition/modules/appsec/config.go#L13-L49","documentation":"Sentinel error errMissingAPIKey returned by Source.checkAuth when the supplied apiKey is the empty string. The appsec remediation component forwards a bearer/API key to LAPI for validation; an empty key is rejected locally before any request is made, so it never contacts LAPI.","triggerScenarios":"Thrown at pkg/acquisition/modules/appsec/config.go:31 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Configure the appsec component to send its API key (the one generated for it in LAPI, e.g. via cscli bouncers/agents creation)","Check that the key is not stripped by a proxy or empty header handling before reaching crowdsec","Unit-tested behavior: an empty key must be rejected without contacting LAPI — do not bypass this guard"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}