crowdsecurity/crowdsec · error

empty cti key

Error message

empty cti key

What it means

CTICfg.Load validates the CrowdSec CTI integration configuration. If the api.cti.key is explicitly set to an empty string (key present in config but blank), the configuration is considered invalid and loading aborts. A nil key simply disables CTI; an empty key is treated as a misconfiguration.

Source

Thrown at pkg/csconfig/api.go:81

	InsecureSkipVerify  *bool              `yaml:"insecure_skip_verify"` // check if api certificate is bad or not
	UnregisterOnExit    bool               `yaml:"unregister_on_exit,omitempty"`
}

type CTICfg struct {
	Key          *string        `yaml:"key,omitempty"`
	CacheTimeout *time.Duration `yaml:"cache_timeout,omitempty"`
	CacheSize    *int           `yaml:"cache_size,omitempty"`
	Enabled      *bool          `yaml:"enabled,omitempty"`
	LogLevel     log.Level      `yaml:"log_level,omitempty"`
}

func (a *CTICfg) Load() error {
	if a.Key == nil {
		a.Enabled = new(false)
	}

	if a.Key != nil && *a.Key == "" {
		return errors.New("empty cti key")
	}

	if a.Enabled == nil {
		a.Enabled = new(true)
	}

	if a.CacheTimeout == nil {
		a.CacheTimeout = new(time.Duration)
		*a.CacheTimeout = 10 * time.Minute
	}

	if a.CacheSize == nil {
		a.CacheSize = new(int)
		*a.CacheSize = 100
	}

	return nil
}

View on GitHub (pinned to 909b515798)

Solutions

1. Provide a real CTI API key from the CrowdSec console under api.cti.key
2. Remove the api.cti.key line entirely so CTI is cleanly disabled
3. If templating, ensure the value renders as YAML null or omit the key when empty

Example fix

// before
# config.yaml
api:
  cti:
    key: ""
// after
# config.yaml
api:
  cti:
    enabled: false
    key: "<your-cti-api-key>"

if cfg.CTI != nil && cfg.CTI.Key != nil && *cfg.CTI.Key == "" {
    return errors.New("api.cti.key is set but empty; provide a key or remove it")
}
if err := cfg.CTI.Load(); err != nil { ... }

func ctiKeyPresent(k *string) bool { return k != nil && strings.TrimSpace(*k) != "" }

if err := apiCfg.CTI.Load(); err != nil {
    return fmt.Errorf("invalid cti configuration: %w", err)
}

When it happens

Trigger: api.cti.key in config.yaml is set to '' (empty string); CTICfg.Load() is invoked during configuration loading and returns this error.

Common situations: Template or environment-variable substitution expanding to an empty value (e.g. CTI_KEY= empty env var rendered into the config); a user deleting the key contents but leaving the key; Helm/Docker config generation producing empty strings.

Understand the failure class

Background: "must not be empty", "cannot be empty" — required-field validation errors across open-source libraries — this error's family across 41 libraries.

Related errors

• no listen_uri or listen_socket specified
• while parsing agents cert auto-delete duration: %w
• while parsing agents login/password auto-delete duration: %w
• while parsing bouncers cert auto-delete duration: %w
• while parsing bouncers api auto-delete duration: %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e7180c5c7b785e01. Report an issue: GitHub.