crowdsecurity/crowdsec · error

loading online client credentials: %w

Error message

loading online client credentials: %w

What it means

LoadAPIServer validates the LAPI server config and, when an OnlineClient (Central API / enrollment) credentials file is configured, loads it via OnlineClient.Load(). Any error from that load — parse failure, missing URL/credentials, unreadable CA cert or client pair — is wrapped with this prefix. It chains errors 765-768 into the server startup path.

Source

Thrown at pkg/csconfig/api.go:374

	}

	if !*c.API.Server.Enable {
		log.Warning("crowdsec local API is disabled because 'enable' is set to false")

		c.DisableAPI = true
	}

	if c.DisableAPI {
		return nil
	}

	if c.API.Server.ListenURI == "" && c.API.Server.ListenSocket == "" {
		return errors.New("no listen_uri or listen_socket specified")
	}

	if c.API.Server.OnlineClient != nil && c.API.Server.OnlineClient.CredentialsFilePath != "" && !skipOnlineCreds {
		if err := c.API.Server.OnlineClient.Load(); err != nil {
			return fmt.Errorf("loading online client credentials: %w", err)
		}
	}

	if (c.API.Server.OnlineClient == nil || c.API.Server.OnlineClient.Credentials == nil) && !inCli {
		log.Info("push and pull to Central API disabled")
	}

	// Set default values for CAPI push/pull
	if c.API.Server.OnlineClient != nil {
		if c.API.Server.OnlineClient.PullConfig.Community == nil {
			c.API.Server.OnlineClient.PullConfig.Community = new(true)
		}

		if c.API.Server.OnlineClient.PullConfig.Blocklists == nil {
			c.API.Server.OnlineClient.PullConfig.Blocklists = new(true)
		}

		if c.API.Server.OnlineClient.Sharing == nil {

View on GitHub (pinned to 909b515798)

Solutions

1. Read the wrapped inner error to find the real cause, then fix the CAPI credentials file at the path given in api.server.online_client.credentials_path.
2. Re-enroll: `cscli capi register && cscli capi enable` (or `cscli console enroll <key>`) to regenerate valid credentials.
3. If the machine should not talk to Central API, remove the online_client section (or its credentials_path) from config.yaml — the server then just logs 'push and pull to Central API disabled'.
4. Pass skipOnlineCreds where the codebase allows it (e.g. some CLI paths) if credentials should not block startup.
5. Check that the credentials file is readable by the crowdsec service user.

Example fix

# before (config.yaml): stale online_client credentials_path
api:
  server:
    online_client:
      credentials_path: /etc/crowdsec/capi_credentials.yaml  # file deleted
# after: drop the block to disable CAPI, or re-enroll to recreate the file
api:
  server:
    online_client: ~

if cfg.API.Server.OnlineClient != nil && cfg.API.Server.OnlineClient.CredentialsFilePath != "" {
    if _, err := os.Stat(cfg.API.Server.OnlineClient.CredentialsFilePath); err != nil {
        log.Warningf("CAPI credentials missing at %s; CAPI push/pull disabled", cfg.API.Server.OnlineClient.CredentialsFilePath)
    }
}

if err := cfg.LoadAPIServer(); err != nil {
    if strings.Contains(err.Error(), "loading online client credentials") {
        // degrade gracefully: disable CAPI instead of failing startup
        log.Warning("CAPI credentials unusable, continuing without Central API")
    } else {
        return err
    }
}

When it happens

Trigger: Config has api.server.online_client.credentials_path set (and skipOnlineCreds is false) and the underlying Load() returns any of: YAML parse error, no credentials/URL in the file, failed CA cert load, or failed client certificate load.

Common situations: crowdsec enrolled once then the CAPI credentials file was deleted or corrupted; config YAML references online_client after `cscli capi unregister` removed the credentials; automated provisioning writes the credentials file after the service starts; wrong credentials_path in config.yaml.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• no configuration paths provided
• while parsing '%s': %w
• failed to load postovflw parser patterns: %w
• failed to load parser config: %w
• path must start with /

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/558d81f3b4fac37a. Report an issue: GitHub.