What causes "access token not configured" in grafana/k6?

Run `k6 cloud login -t --stack ` to validate and persist the token

access token not configured

Error message

access token not configured

What it means

errMissingToken is the specific leg of the auth check in checkCloudLoginFor: `conf.Token` is either not set or an empty string, so every cloud API call would be rejected. k6 reports it wrapped under the command's auth prefix together with the `k6 cloud login` advisory. No HTTP request is made — the check is purely local config validation.

Solutions

Run `k6 cloud login -t <token> --stack <stack>` to validate and persist the token
In CI, export K6_CLOUD_TOKEN (a Grafana Cloud access policy token with the k6 scope) as a masked secret
Verify what is stored with `k6 cloud login -s`
Check for a trailing typo in the env var name (K6_CLOUD_TOKEN, not K6_CLOUD_API_TOKEN)

Example fix

# before
k6 cloud run script.js  # -> access token not configured

# after
export K6_CLOUD_TOKEN="glc_ey..."   # or: k6 cloud login -t glc_ey... --stack my-team
k6 cloud run script.js

Defensive patterns

Strategy: validation

Validate before calling

# fail fast before running k6 cloud commands
: "${K6_CLOUD_TOKEN:?K6_CLOUD_TOKEN must be set (Grafana Cloud access policy token)}"

Prevention

Name the CI secret exactly K6_CLOUD_TOKEN and mark it required
Run `k6 cloud login -s` after setup to confirm the token row is populated
Rotate tokens on a schedule and update the secret before expiry, not after

When it happens

Trigger: Any cloud sub-command (cloud run/upload, project list, test list) with no token anywhere in the config precedence chain: no `k6 cloud login` stored token, no K6_CLOUD_TOKEN env var, no token in the config file. Typically after a fresh install, after `k6 cloud login -r` reset, or when a CI job never exported the secret.

Common situations: New machines/CI images without login state; the CI secret for K6_CLOUD_TOKEN not configured or misnamed; the token key in the JSON config file deleted by hand; using a K6_CONFIG file that lacks the cloud section.

Related errors

AI-assisted analysis of grafana/k6@94169daab2 (2026-08-18). Data as JSON: /api/errors/2fb5169435b4dbd5. Report an issue: GitHub.

Appendix: source

Thrown at internal/cmd/cloud.go:39

	"go.k6.io/k6/v2/errext/exitcodes"
	"go.k6.io/k6/v2/internal/build"
	cloudapiv6 "go.k6.io/k6/v2/internal/cloudapi/v6"
	"go.k6.io/k6/v2/internal/ui/pb"
	"go.k6.io/k6/v2/lib"

	"github.com/fatih/color"
	"github.com/spf13/cobra"
	"github.com/spf13/pflag"
)

const cloudRunAuthPrefix = "Running cloud tests requires auth settings"

var (
	errCloudAuth = errors.New( //nolint:staticcheck // user-facing error message, capitalization is intentional
		"Run `k6 cloud login` to authenticate, or check the docs for other options at" +
			" https://grafana.com/docs/grafana-cloud/testing/k6/author-run/tokens-and-cli-authentication",
	)
	errMissingToken   = errors.New("access token not configured")
	errMissingStackID = errors.New("stack ID not configured")

	// errNoProjectConfigured is returned by cloud sub-commands that require a
	// concrete project to operate on when none can be resolved from the flags,
	// the environment, or the logged-in configuration.
	errNoProjectConfigured = errors.New(
		"no project specified. Use --project-id, set K6_CLOUD_PROJECT_ID, or run `k6 cloud login` to set a default project",
	)
)

// checkCloudLogin verifies that both a token and a stack are configured.
// Together they represent a complete Grafana Cloud login.
func checkCloudLogin(conf cloudapi.Config) error {
	return checkCloudLoginFor(conf, cloudRunAuthPrefix)
}

func checkCloudLoginFor(conf cloudapi.Config, prefix string) error {
	if !conf.Token.Valid || conf.Token.String == "" {

View on GitHub (pinned to 94169daab2)