crowdsecurity/crowdsec · error

missing token value for api.server.auto_register

Error message

missing token value for api.server.auto_register

What it means

LoadAutoRegister validates the api.server.auto_register feature, which lets the LAPI auto-enroll agents. When auto_register is enabled, a registration token is mandatory; a missing token aborts config loading.

Source

Thrown at pkg/csconfig/api.go:539

	if c.AutoRegister == nil {
		c.AutoRegister = &LocalAPIAutoRegisterCfg{
			Enable: new(false),
		}

		return nil
	}

	// Disable by default
	if c.AutoRegister.Enable == nil {
		c.AutoRegister.Enable = new(false)
	}

	if !*c.AutoRegister.Enable {
		return nil
	}

	if c.AutoRegister.Token == "" {
		return errors.New("missing token value for api.server.auto_register")
	}

	if len(c.AutoRegister.Token) < 32 {
		return errors.New("token value for api.server.auto_register is too short (min 32 characters)")
	}

	if c.AutoRegister.AllowedRanges == nil {
		return errors.New("missing allowed_ranges value for api.server.auto_register")
	}

	c.AutoRegister.AllowedRangesParsed = make([]*net.IPNet, 0, len(c.AutoRegister.AllowedRanges))

	for _, ipRange := range c.AutoRegister.AllowedRanges {
		_, ipNet, err := net.ParseCIDR(ipRange)
		if err != nil {
			return fmt.Errorf("auto_register: failed to parse allowed range '%s': %w", ipRange, err)
		}

View on GitHub (pinned to 909b515798)

Solutions

1. Generate a token (32+ chars) and set it under api.server.auto_register.token
2. Set api.server.auto_register.enable: false if auto-enrollment is not wanted
3. Render the token via secret management in templated deployments

Example fix

// before
api:
  server:
    auto_register:
      enable: true
// after
api:
  server:
    auto_register:
      enable: true
      token: "0123456789abcdef0123456789abcdef"

if cfg.AutoRegister != nil && cfg.AutoRegister.Enable != nil && *cfg.AutoRegister.Enable && cfg.AutoRegister.Token == "" {
    return errors.New("auto_register enabled without token")
}

if err := serverCfg.LoadAutoRegister(); err != nil {
    return fmt.Errorf("auto_register config: %w", err)
}

When it happens

Trigger: api.server.auto_register.enable: true with no api.server.auto_register.token set (empty string); LocalApiServerCfg.LoadAutoRegister() during LAPI config load.

Common situations: Enabling auto_register in a Helm chart or config template that omits the token; copying an auto_register block from docs without filling in the token; forgetting the token after upgrading to a version that introduced auto_register.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

• missing allowed_ranges value for api.server.auto_register
• no listen_uri or listen_socket specified
• no API client section in configuration
• empty cti key
• cannot use TLS with a unix socket

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/32f68d966d0f8042. Report an issue: GitHub.