crowdsecurity/crowdsec · error · errMissingAPIKey

missing API key

Error message

missing API key

What it means

Sentinel error errMissingAPIKey returned by Source.checkAuth when the supplied apiKey is the empty string. The appsec remediation component forwards a bearer/API key to LAPI for validation; an empty key is rejected locally before any request is made, so it never contacts LAPI.

Source

Thrown at pkg/acquisition/modules/appsec/config.go:31

	"time"

	yaml "github.com/goccy/go-yaml"
	"github.com/google/uuid"
	"github.com/prometheus/client_golang/prometheus"
	log "github.com/sirupsen/logrus"

	"github.com/crowdsecurity/crowdsec/pkg/acquisition/configuration"
	"github.com/crowdsecurity/crowdsec/pkg/apiclient/useragent"
	"github.com/crowdsecurity/crowdsec/pkg/appsec"
	"github.com/crowdsecurity/crowdsec/pkg/appsec/allowlists"
	"github.com/crowdsecurity/crowdsec/pkg/appsec/challenge"
	"github.com/crowdsecurity/crowdsec/pkg/cwhub"
	"github.com/crowdsecurity/crowdsec/pkg/exprhelpers"
	"github.com/crowdsecurity/crowdsec/pkg/metrics"
)

var (
	errMissingAPIKey = errors.New("missing API key")
	errInvalidAPIKey = errors.New("invalid API key")
)

var (
	DefaultAuthCacheDuration = (1 * time.Minute)
	DefaultAuthTimeout       = (200 * time.Millisecond)
	DefaultBodyReadTimeout   = (1 * time.Second)
)

// configuration structure of the acquis for the application security engine
type Configuration struct {
	ListenAddr        string         `yaml:"listen_addr"`
	ListenSocket      string         `yaml:"listen_socket"`
	CertFilePath      string         `yaml:"cert_file"`
	KeyFilePath       string         `yaml:"key_file"`
	Path              string         `yaml:"path"`
	Routines          int            `yaml:"routines"`
	AppsecConfig      string         `yaml:"appsec_config"`

View on GitHub (pinned to 909b515798)

Solutions

1. Configure the appsec component to send its API key (the one generated for it in LAPI, e.g. via cscli bouncers/agents creation)
2. Check that the key is not stripped by a proxy or empty header handling before reaching crowdsec
3. Unit-tested behavior: an empty key must be rejected without contacting LAPI — do not bypass this guard

When it happens

Trigger: Thrown at pkg/acquisition/modules/appsec/config.go:31 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e94112e9c48dc0d7. Report an issue: GitHub.