crowdsecurity/crowdsec · error

authenticate watcher (%s): %w

Error message

authenticate watcher (%s): %w

What it means

The watcher (crowdsec agent) failed to authenticate against the Central API (CAPI) with the given login. The CAPI rejected the credentials, the machine is not yet validated, or the API endpoint was unreachable/misconfigured. Includes the login name so the offending machine identity is identifiable in enrollment logs.

Source

Thrown at pkg/apiserver/apic.go:281

		return nil
	}

	log.WithError(err).Debug("No useful token, authenticating")

	scenarios, err := a.FetchScenariosListFromDB(ctx)
	if err != nil {
		return fmt.Errorf("get scenario in db: %w", err)
	}

	password := strfmt.Password(config.Credentials.Password)

	authResp, _, err := a.apiClient.Auth.AuthenticateWatcher(ctx, models.WatcherAuthRequest{
		MachineID: &config.Credentials.Login,
		Password:  &password,
		Scenarios: scenarios,
	})
	if err != nil {
		return fmt.Errorf("authenticate watcher (%s): %w", config.Credentials.Login, err)
	}

	if err = transport.Expiration.UnmarshalText([]byte(authResp.Expire)); err != nil {
		return fmt.Errorf("unable to parse jwt expiration: %w", err)
	}

	transport.Token = authResp.Token

	return a.dbClient.SaveAPICToken(ctx, authResp.Token)
}

// keep track of all alerts in cache and push it to CAPI every PushInterval.
func (a *apic) Push(ctx context.Context) error {
	var cache modelscapi.AddSignalsRequest

	ticker := time.NewTicker(a.pushIntervalFirst)

	log.Infof("Start push to CrowdSec Central API (interval: %s once, then %s)", a.pushIntervalFirst.Round(time.Second), a.pushInterval)

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the credentials in the online API credentials file match a registered CAPI machine
2. Check that the machine is validated: `cscli capi status` and re-register with `cscli capi register` if needed
3. Confirm network access and URL of the Central API — proxies, TLS interception or DNS failures surface here
4. Check CAPI-side status and retry later if the Central API returned a transient 5xx

When it happens

Trigger: Thrown at pkg/apiserver/apic.go:281 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/81318c5bc8b4e055. Report an issue: GitHub.