failed to parse api server credentials configuration file '%

Error message

failed to parse api server credentials configuration file '%s': %w

What it means

YAML decoding of the online API credentials file failed with a non-EOF error. Because the decoder runs with KnownFields(true), both malformed YAML and unknown/misspelled keys in the file land here. The file exists and was read fine; its content does not match the expected schema.

Source

Thrown at pkg/csconfig/api.go:116

	return nil
}

// Load loads the online credentials from the specified file, returning fs.ErrNotExist if the file does not exist.
func (o *OnlineApiClientCfg) Load() error {
	o.Credentials = new(ApiCredentialsCfg)

	fcontent, err := os.ReadFile(o.CredentialsFilePath)
	if err != nil {
		return err
	}

	dec := yaml.NewDecoder(bytes.NewReader(fcontent))
	dec.KnownFields(true)

	err = dec.Decode(o.Credentials)
	if err != nil {
		if !errors.Is(err, io.EOF) {
			return fmt.Errorf("failed to parse api server credentials configuration file '%s': %w", o.CredentialsFilePath, err)
		}
	}

	switch {
	case o.Credentials.Login == "" && o.Credentials.Password == "" && o.Credentials.URL == "":
		// An empty credentials file just means the engine was never registered against CAPI.
		log.Debugf("no CAPI credentials found in '%s', engine is not registered", o.CredentialsFilePath)
		o.Credentials = nil
	case o.Credentials.Login == "":
		log.Warningf("can't load CAPI credentials from '%s' (missing login field)", o.CredentialsFilePath)
		o.Credentials = nil
	case o.Credentials.Password == "":
		log.Warningf("can't load CAPI credentials from '%s' (missing password field)", o.CredentialsFilePath)
		o.Credentials = nil
	case o.Credentials.URL == "":
		log.Warningf("can't load CAPI credentials from '%s' (missing url field)", o.CredentialsFilePath)
		o.Credentials = nil
	}

View on GitHub (pinned to 909b515798)

Solutions

Check the wrapped YAML error for line/key details
Remove unknown keys — strict parsing rejects leftovers from manual edits or old versions
If registration state is broken, back up the file and re-run `cscli capi register` to regenerate it

Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at pkg/csconfig/api.go:116 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/f36c696418afd6ec. Report an issue: GitHub.