What causes "missing lapi client credentials" in crowdsecurity/crowdsec?

Add a valid credentials block (url and api_key for your LAPI) to the appsec datasource config

missing lapi client credentials

Error message

missing lapi client credentials

What it means

After parsing the YAML, Configure() validates that the LAPI client configuration carries Credentials. Without credentials the datasource cannot authenticate to LAPI to fetch decisions for the AppSec component. The YAML must contain a valid url/api_key (or similar) credentials block.

Source

Thrown at pkg/acquisition/modules/appsec/config.go:201

	return toLoad, nil
}

func (w *Source) Configure(ctx context.Context, yamlConfig []byte, logger *log.Entry, _ metrics.AcquisitionMetricsLevel) error {
	if w.hub == nil {
		return errors.New("appsec datasource requires a hub. this is a bug, please report")
	}

	if w.lapiClientConfig == nil {
		return errors.New("appsec datasource requires a lapi client configuration. this is a bug, please report")
	}

	if err := w.UnmarshalConfig(yamlConfig); err != nil {
		return fmt.Errorf("unable to parse appsec configuration: %w", err)
	}

	if w.lapiClientConfig.Credentials == nil {
		return errors.New("missing lapi client credentials")
	}

	w.lapiURL = fmt.Sprintf("%sv1/decisions/stream", w.lapiClientConfig.Credentials.URL)
	w.AuthCache = NewAuthCache()

	w.logger = logger
	w.logger.Tracef("Appsec configuration: %+v", w.config)

	if w.config.AuthCacheDuration == nil {
		w.config.AuthCacheDuration = &DefaultAuthCacheDuration
		w.logger.Infof("Cache duration for auth not set, using default: %v", *w.config.AuthCacheDuration)
	}

	if w.config.AuthTimeout == nil {
		w.config.AuthTimeout = &DefaultAuthTimeout
		w.logger.Infof("Auth timeout not set, using default: %v", *w.config.AuthTimeout)
	}

View on GitHub (pinned to 909b515798)

Solutions

Add a valid credentials block (url and api_key for your LAPI) to the appsec datasource config
Check for YAML indentation mistakes that nest credentials outside the datasource stanza
Regenerate the datasource config with cscli or from the hub docs to confirm the expected fields

Example fix

// before (acquisition.yaml)
source: appsec
listen_addr: 127.0.0.1:7422
// after
source: appsec
listen_addr: 127.0.0.1:7422
lapi_client:
  credentials:
    url: http://127.0.0.1:8080
    api_key: <your-registered-bouncer-key>

Defensive patterns

Strategy: validation

Validate before calling

if cfg.LapiClient == nil || cfg.LapiClient.Credentials == nil || cfg.LapiClient.Credentials.URL == "" {
    return errors.New("appsec datasource needs lapi credentials (url + api_key)")
}

Try / catch

if err := src.Configure(ctx, yaml, logger, lvl); err != nil {
    if strings.Contains(err.Error(), "missing lapi client credentials") { /* fix config */ }
    return err
}

Prevention

Always include a credentials block with url and api_key in appsec datasource configs
Register a bouncer API key with cscli before writing the config
Validate YAML indentation before starting crowdsec

When it happens

Trigger: An appsec acquisition config (or the data_source section) whose lapi_client credentials are absent: e.g. missing the credentials URL and API key block, or credentials present but null.

Common situations: Hand-written appsec.yaml acquisition file missing the credentials section; copying an appsec datasource snippet that omits lapi credentials; migration from an older config schema where credentials were supplied differently.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/310b96260c002241. Report an issue: GitHub.