What causes "token not found in DB" in crowdsecurity/crowdsec?

Enroll the instance: cscli capi enroll

token not found in DB

Error message

token not found in DB

What it means

LoadAPICToken fetches the CAPI (community blocklist) JWT from the local DB. ErrTokenNotFound is a sentinel returned when the stored apic_token value is empty or absent, meaning this instance has never received/persisted a token. It is designed for errors.Is checks so callers can trigger re-enrollment.

Source

Thrown at pkg/database/token.go:16

package database

import (
	"context"
	"errors"
	"fmt"
	"time"

	"github.com/golang-jwt/jwt/v4"
	"github.com/sirupsen/logrus"
)

const APICTokenKey = "apic_token"

var (
	ErrTokenNotFound     = errors.New("token not found in DB")
	ErrTokenParse        = errors.New("unable to parse token")
	ErrTokenMissingClaim = errors.New("token missing required claim")
	ErrTokenExpired      = errors.New("token expired")
)

type APICToken struct {
	Raw       string
	ExpiresAt time.Time
}

// LoadAPICToken attempts to retrieve and validate a JWT token from the local database.
// Errors are returned if the token can't be read, is not valid, expired or has no expiration.
func (c *Client) LoadAPICToken(ctx context.Context, logger logrus.FieldLogger) (APICToken, error) {
	token, err := c.GetConfigItem(ctx, APICTokenKey) // TokenKey is a constant string representing the key for the token in the database
	if err != nil {
		return APICToken{}, fmt.Errorf("loading token: %w", err)
	}

View on GitHub (pinned to 909b515798)

Solutions

Enroll the instance: cscli capi enroll <enroll_key>
Ignore the error if unenrolled operation is expected (check with errors.Is(ErrTokenNotFound))
Re-run enrollment to repopulate the apic_token row

Example fix

tok, err := client.LoadAPICToken(ctx)
if errors.Is(err, dbclient.ErrTokenNotFound) {
    // not enrolled yet, skip CAPI pull
    return nil
}

Defensive patterns

Strategy: try-catch

Try / catch

tok, err := client.LoadAPICToken(ctx)
if errors.Is(err, dbclient.ErrTokenNotFound) {
    // not enrolled: skip CAPI pull or trigger enrollment
    return nil
}
if err != nil {
    return err
}

Prevention

Enroll the instance at setup time (cscli capi enroll)
Check enrollment status before pulling CAPI data
Use errors.Is against the exported sentinel, not string matching

When it happens

Trigger: Calling LoadAPICToken before the instance is enrolled with CAPI, or after the token row was deleted/flushed from the DB.

Common situations: Fresh crowdsec install not yet enrolled (cscli capi enroll not run), token wiped by DB flush, testing without internet/enrollment.

Understand the failure class

Background: Record Not Found Errors: "not found", RecordNotFound, and "was not found" — what they mean and how to fix them — this error's family across 28 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/4d4cba3dfb9221f4. Report an issue: GitHub.