What causes "no API client section in configuration" in crowdsecurity/crowdsec?

Add the api.client section with credentials_file pointing to the local credentials yaml

no API client section in configuration

Error message

no API client section in configuration

What it means

LoadAPIClient loads the LAPI client credentials for the crowdsec agent. It requires the api section, api.client section, and a credentials file path to exist, and that the agent is not disabled; otherwise it reports that no API client section is present. This distinguishes 'agent cannot talk to LAPI' misconfigurations from valid no-API setups.

Source

Thrown at pkg/csconfig/api.go:514

	fd, err := os.Open(c.CapiWhitelistsPath)
	if err != nil {
		return fmt.Errorf("while opening capi whitelist file: %w", err)
	}

	defer fd.Close()

	c.CapiWhitelists, err = parseCapiWhitelists(fd)
	if err != nil {
		return fmt.Errorf("while parsing capi whitelist file '%s': %w", c.CapiWhitelistsPath, err)
	}

	return nil
}

func (c *Config) LoadAPIClient() error {
	if c.API == nil || c.API.Client == nil || c.API.Client.CredentialsFilePath == "" || c.DisableAgent {
		return errors.New("no API client section in configuration")
	}

	return c.API.Client.Load()
}

func (c *LocalApiServerCfg) LoadAutoRegister() error {
	if c.AutoRegister == nil {
		c.AutoRegister = &LocalAPIAutoRegisterCfg{
			Enable: new(false),
		}

		return nil
	}

	// Disable by default
	if c.AutoRegister.Enable == nil {
		c.AutoRegister.Enable = new(false)
	}

View on GitHub (pinned to 909b515798)

Solutions

Add the api.client section with credentials_file pointing to the local credentials yaml
Run 'cscli lapi register' to generate the credentials file, then re-check indentation
If no LAPI connection is desired, ensure the agent is intentionally configured as standalone and this error is expected

Example fix

# before: no api.client in config.yaml
# after
api:
  client:
    insecure_skip_verify: false
    credentials_file: /etc/crowdsec/local_api_credentials.yaml

Defensive patterns

Strategy: try-catch

Validate before calling

if cfg.API == nil || cfg.API.Client == nil || cfg.API.Client.CredentialsFilePath == "" {
    // run standalone or register first: cscli lapi register
}

Try / catch

if err := cfg.LoadAPIClient(); err != nil {
    return fmt.Errorf("lapi client: %w", err)
}

Prevention

Run 'cscli lapi register' on agent hosts so the credentials file and api.client section exist
Keep the default config.yaml api.client block intact when trimming configs
Verify yaml indentation so api.client is not nested under the wrong key

When it happens

Trigger: Running crowdsec in agent mode when config.yaml lacks api.client, or lacks api entirely, or api.client.credentials has no credentials_file, or api.client is disabled via disable_agent; LoadCrowdsec -> LoadAPIClient path.

Common situations: A parser-only/standalone crowdsec install where the api section was removed; a mis-indented yaml that swallows the client block into another key; fresh installs whose default config was replaced by a minimal one.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/44e937c912423725. Report an issue: GitHub.