token value for api.server.auto_register is too short (min 3

Error message

token value for api.server.auto_register is too short (min 32 characters)

What it means

LoadAutoRegister additionally enforces a minimum length of 32 characters for the auto_register token, since it is used as a security credential for agent enrollment. Tokens shorter than 32 characters are rejected as too weak.

Source

Thrown at pkg/csconfig/api.go:543

		return nil
	}

	// Disable by default
	if c.AutoRegister.Enable == nil {
		c.AutoRegister.Enable = new(false)
	}

	if !*c.AutoRegister.Enable {
		return nil
	}

	if c.AutoRegister.Token == "" {
		return errors.New("missing token value for api.server.auto_register")
	}

	if len(c.AutoRegister.Token) < 32 {
		return errors.New("token value for api.server.auto_register is too short (min 32 characters)")
	}

	if c.AutoRegister.AllowedRanges == nil {
		return errors.New("missing allowed_ranges value for api.server.auto_register")
	}

	c.AutoRegister.AllowedRangesParsed = make([]*net.IPNet, 0, len(c.AutoRegister.AllowedRanges))

	for _, ipRange := range c.AutoRegister.AllowedRanges {
		_, ipNet, err := net.ParseCIDR(ipRange)
		if err != nil {
			return fmt.Errorf("auto_register: failed to parse allowed range '%s': %w", ipRange, err)
		}

		c.AutoRegister.AllowedRangesParsed = append(c.AutoRegister.AllowedRangesParsed, ipNet)
	}

	return nil

View on GitHub (pinned to 909b515798)

Solutions

Use a token of at least 32 characters, e.g. `openssl rand -hex 16` output
Pad/replace the existing short token in api.server.auto_register.token
If you cannot generate one, reuse an existing enrollment token of adequate length

Example fix

// before
auto_register:
  enable: true
  token: "short-token"
// after
auto_register:
  enable: true
  token: "e3b0c44298fc1c149afbf4c8996fb924"

Defensive patterns

Strategy: validation

Validate before calling

if len(cfg.AutoRegister.Token) < 32 {
    return errors.New("auto_register token must be at least 32 characters")
}

Try / catch

if err := serverCfg.LoadAutoRegister(); err != nil {
    return fmt.Errorf("auto_register config: %w", err)
}

Prevention

Always generate tokens of 32+ random hex characters
Check token length after templating to catch truncation
Document the 32-char minimum wherever auto_register is configured

When it happens

Trigger: api.server.auto_register.enable: true with a token string of length 1-31; LocalApiServerCfg.LoadAutoRegister() length check fails during config load.

Common situations: Manually invented short tokens ('mytoken', 16-char UUIDs); users unaware of the documented minimum; truncated tokens produced by templating or copy-paste.

Understand the failure class

Background: "value must be between 0 and 1" / "out of range" / "must not be negative" errors: fixing range-validation failures across open-source libraries — this error's family across 42 libraries.

Related errors

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/e13cc2cfe18a24bc. Report an issue: GitHub.