crowdsecurity/crowdsec · error

invalid token for auto registration

Error message

invalid token for auto registration

What it means

When a watcher hits the machines enrollment endpoint with a pre-existing token, shouldAutoRegister compares it against the controller's auto-registration token (api.server.auto_register.token in the LAPI config). A mismatch rejects the enrollment attempt.

Source

Thrown at pkg/apiserver/controllers/v1/machines.go:35

	if c.AutoRegisterCfg == nil || c.AutoRegisterCfg.Enable == nil || !*c.AutoRegisterCfg.Enable {
		return false, nil
	}

	clientIP := net.ParseIP(gctx.ClientIP())

	// Can probaby happen if using unix socket ?
	if clientIP == nil {
		log.Warnf("Failed to parse client IP for watcher self registration: %s", gctx.ClientIP())
		return false, nil
	}

	if token == "" {
		return false, nil
	}

	// Check the token
	if token != c.AutoRegisterCfg.Token {
		return false, errors.New("invalid token for auto registration")
	}

	// Check the source IP
	for _, ipRange := range c.AutoRegisterCfg.AllowedRangesParsed {
		if ipRange.Contains(clientIP) {
			return true, nil
		}
	}

	return false, errors.New("IP not in allowed range for auto registration")
}

func (c *Controller) CreateMachine(gctx *gin.Context) {
	ctx := gctx.Request.Context()

	var input models.WatcherRegistrationRequest

	if err := gctx.ShouldBindJSON(&input); err != nil {

View on GitHub (pinned to 909b515798)

Solutions

1. Compare the token sent by the watcher with api.server.auto_register.token on the LAPI host and align them.
2. Regenerate the enrollment token if needed (cscli or config) and re-enroll the machine with cscli lapi register -u ... -t <token>.
3. If manual registration is intended, don't send the auto-register token header at all (empty token skips the check).

Example fix

# before (LAPI config)
auto_register:
  token: ${AUTOADD_TOKEN}
# after - verify the watcher registers with the same token:
# cscli lapi register -u http://lapi:8080 -t <value of AUTOADD_TOKEN on the server>

if enrollmentToken != lapiAutoRegisterToken {
    return errors.New("token mismatch with LAPI auto_register token")
}

_, err := client.Register(ctx, url, token)
if err != nil && strings.Contains(err.Error(), "invalid token") {
    // re-read token from the LAPI host and retry registration
    token = readServerToken()
    _, err = client.Register(ctx, url, token)
}

When it happens

Trigger: POST /v1/watchers with an authorization token that is non-empty but differs from the LAPI's auto_register token value.

Common situations: Stale token after the LAPI config was regenerated; token copied from a different crowdsec instance; whitespace/quoting differences in YAML; machine enrolling against the wrong LAPI.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• IP not in allowed range for auto registration
• bouncer not found
• failed to extract claims
• tls authentication required
• authenticate watcher (%s): %w

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/6f707cad560e0a93. Report an issue: GitHub.