What causes "loading CTI configuration: %w" in crowdsecurity/crowdsec?

Set a valid key under api.cti.key in config.yaml

loading CTI configuration: %w

Error message

loading CTI configuration: %w

What it means

When an api.cti section is present in config.yaml, LoadAPIServer calls CTI.Load(), and any failure (typically a missing/empty API key or invalid key format) is wrapped with this prefix. The CTI section integrates CrowdSec Threat Intelligence lookups into the console.

Source

Thrown at pkg/csconfig/api.go:439

	if c.API.Server.TrustedProxies != nil {
		c.API.Server.UseForwardedForHeaders = true
	}

	if err := c.API.Server.LoadProfiles(); err != nil {
		return fmt.Errorf("while loading profiles for LAPI: %w", err)
	}

	if c.API.Server.ConsoleConfigPath == "" {
		c.API.Server.ConsoleConfigPath = DefaultConsoleConfigFilePath
	}

	if err := c.API.Server.LoadConsoleConfig(); err != nil {
		return fmt.Errorf("while loading console options: %w", err)
	}

	if c.API.CTI != nil {
		if err := c.API.CTI.Load(); err != nil {
			return fmt.Errorf("loading CTI configuration: %w", err)
		}
	}

	return nil
}

// we cannot unmarshal to type net.IPNet, so we need to do it manually
type capiWhitelists struct {
	Ips   []string `yaml:"ips"`
	Cidrs []string `yaml:"cidrs"`
}

func parseCapiWhitelists(fd io.Reader) (*CapiWhitelist, error) {
	fromCfg := capiWhitelists{}

	decoder := yaml.NewDecoder(fd)
	if err := decoder.Decode(&fromCfg); err != nil {
		if errors.Is(err, io.EOF) {

View on GitHub (pinned to 909b515798)

Solutions

Set a valid key under api.cti.key in config.yaml
Remove or comment out the whole api.cti section if you don't use CTI key sharing
Get/renew a key from the CrowdSec CTI console page
Check the wrapped inner error for the exact validation failure

Example fix

// before (config.yaml)
api:
  cti:
    enabled: true
    key: ""
// after
api:
  cti:
    enabled: true
    key: "<your-cti-api-key>"

Defensive patterns

Strategy: validation

Validate before calling

// before enabling CTI, ensure the key is set and non-empty
if cti != nil && cti.Key == "" {
	return errors.New("api.cti enabled but key is empty — get one at the CTI console")
}

Try / catch

if err := cfg.LoadAPIServer(); err != nil {
	if strings.Contains(err.Error(), "CTI configuration") {
		log.Warnf("CTI disabled due to config problem: %v", err)
		cfg.API.CTI = nil
		return nil
	}
	return err
}

Prevention

Only add the api.cti block after obtaining a real key from the CTI dashboard
Never commit a config with an empty key field
Remove the whole cti block rather than leaving it half-filled

When it happens

Trigger: crowdsec startup with `api.cti` defined in config.yaml but cti.key empty, or key not matching the expected format enforced by CTI.Load().

Common situations: User enabled the CTI block after copying an example config without inserting their CrowdSec CTI API key; key revoked/typo'd; running key validation during config load fails.

Understand the failure class

Background: "API key is required" / "API key not found" / "No API key was set": the missing-api-key error family across 16 libraries — this error's family across 16 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/871e62c199006fbd. Report an issue: GitHub.