crowdsecurity/crowdsec · error · errInvalidAPIKey

invalid API key

Error message

invalid API key

What it means

Sentinel error errInvalidAPIKey returned by Source.checkAuth in two cases: (1) LAPI could not vouch for the key and it is not in the local auth cache, or (2) LAPI explicitly answered that the key is not authorized, in which case the cached entry is evicted with AuthCache.Delete. It means the presented API key exists syntactically but failed authentication against LAPI.

Source

Thrown at pkg/acquisition/modules/appsec/config.go:32

	yaml "github.com/goccy/go-yaml"
	"github.com/google/uuid"
	"github.com/prometheus/client_golang/prometheus"
	log "github.com/sirupsen/logrus"

	"github.com/crowdsecurity/crowdsec/pkg/acquisition/configuration"
	"github.com/crowdsecurity/crowdsec/pkg/apiclient/useragent"
	"github.com/crowdsecurity/crowdsec/pkg/appsec"
	"github.com/crowdsecurity/crowdsec/pkg/appsec/allowlists"
	"github.com/crowdsecurity/crowdsec/pkg/appsec/challenge"
	"github.com/crowdsecurity/crowdsec/pkg/cwhub"
	"github.com/crowdsecurity/crowdsec/pkg/exprhelpers"
	"github.com/crowdsecurity/crowdsec/pkg/metrics"
)

var (
	errMissingAPIKey = errors.New("missing API key")
	errInvalidAPIKey = errors.New("invalid API key")
)

var (
	DefaultAuthCacheDuration = (1 * time.Minute)
	DefaultAuthTimeout       = (200 * time.Millisecond)
	DefaultBodyReadTimeout   = (1 * time.Second)
)

// configuration structure of the acquis for the application security engine
type Configuration struct {
	ListenAddr        string         `yaml:"listen_addr"`
	ListenSocket      string         `yaml:"listen_socket"`
	CertFilePath      string         `yaml:"cert_file"`
	KeyFilePath       string         `yaml:"key_file"`
	Path              string         `yaml:"path"`
	Routines          int            `yaml:"routines"`
	AppsecConfig      string         `yaml:"appsec_config"`
	AppsecConfigs     []string       `yaml:"appsec_configs"`

View on GitHub (pinned to 909b515798)

Solutions

1. Verify the API key matches one registered in LAPI (cscli bouncers list / agents list); regenerate if needed
2. Check clocks and TLS between the appsec component and LAPI — an LAPI outage with a cold auth cache also surfaces as this error
3. If the key was recently revoked, restart or reconfigure the component with a valid key; the cache entry is evicted on rejection

When it happens

Trigger: Thrown at pkg/acquisition/modules/appsec/config.go:32 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/5bbf8d61a00b6ab8. Report an issue: GitHub.