crowdsecurity/crowdsec · error

client not initialized

Error message

client not initialized

What it means

GetLAPIClient returns the package-level LAPI client created by an earlier initialization call. If that initialization never ran (or ran only in another process), the singleton is nil and the accessor fails rather than returning a nil client.

Source

Thrown at pkg/apiclient/client.go:147

		return fmt.Errorf("authenticate watcher (%s): %w", login, err)
	}

	var expiration time.Time
	if err := expiration.UnmarshalText([]byte(authResp.Expire)); err != nil {
		return fmt.Errorf("unable to parse jwt expiration: %w", err)
	}

	client.GetClient().Transport.(*JWTTransport).Token = authResp.Token
	client.GetClient().Transport.(*JWTTransport).Expiration = expiration

	lapiClient = client

	return nil
}

func GetLAPIClient() (*ApiClient, error) {
	if lapiClient == nil {
		return nil, errors.New("client not initialized")
	}

	return lapiClient, nil
}

func NewClient(config *Config) *ApiClient {
	userAgent := config.UserAgent
	if userAgent == "" {
		userAgent = useragent.Default()
	}

	t := &JWTTransport{
		MachineID:      &config.MachineID,
		Password:       &config.Password,
		UserAgent:      userAgent,
		VersionPrefix:  config.VersionPrefix,
		UpdateScenario: config.UpdateScenario,
		RetryConfig: NewRetryConfig(

View on GitHub (pinned to 909b515798)

Solutions

1. Ensure the client is initialized (config load / NewClient path) before calling GetLAPIClient
2. In standalone code, create the client explicitly with apiclient.NewClient(&Config{...}) instead of the singleton
3. Skip or guard LAPI-dependent calls when LAPI is disabled in the configuration

Example fix

// before
client, err := apiclient.GetLAPIClient()
// after
client, err := apiclient.GetLAPIClient()
if err != nil {
    client = apiclient.NewClient(cfg) // or return/skip: LAPI not initialized
}

// Go: check initialization state before depending on the singleton
// ensure the config-load path that sets lapiClient has already run
client, err := apiclient.GetLAPIClient()
if err != nil {
    client = apiclient.NewClient(cfg) // explicit fallback
}

client, err := apiclient.GetLAPIClient()
if err != nil {
    return fmt.Errorf("LAPI client unavailable (not initialized): %w", err)
}

When it happens

Trigger: Calling GetLAPIClient before any init function that assigns lapiClient (e.g. before crowdsec's configuration loading), or in a separate binary/tool that never performed LAPI setup.

Common situations: Custom integrations importing apiclient and fetching the client at init time before config is parsed; tests that call GetLAPIClient without NewClient/initialization; calling from a code path (like unregisterWatcher) that runs when LAPI is disabled in config.

Understand the failure class

Background: "not installed", "pip install", "required for": how missing-dependency errors surface across open-source libraries — this error's family across 34 libraries.

Related errors

• appsec datasource requires a hub. this is a bug, please repo
• appsec datasource requires a lapi client configuration. this
• controller init: %w
• missing lapi client credentials
• APIKey is empty

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/afb09c6c1c652a05. Report an issue: GitHub.