What causes "cloud secrets not configured: endpoint not set" in grafana/k6?

Set K6_CLOUD_SECRETS_ENDPOINT (together with the token), e.g. https://cloudapi.k6.io/v1/secrets

cloud secrets not configured: endpoint not set

Error message

cloud secrets not configured: endpoint not set

What it means

Returned while initializing the cloud secrets URL source when a secrets configuration has a Token but its Endpoint is empty. The endpoint becomes the URL template (envCopy["K6_SECRET_SOURCE_URL_URL_TEMPLATE"]) used to fetch each secret, so without it the URL source cannot be constructed at all.

Source

Thrown at internal/secretsource/cloud/cloud.go:119

	}

	// (Re-)initialize for the new config.
	cs.activeCfg = current
	cs.urlSource = nil
	cs.initErr = nil

	if current == nil {
		cs.initErr = cs.notConfiguredError()
		return nil, cs.initErr
	}

	if current.Token == "" {
		cs.initErr = errors.New("cloud secrets not configured: token not set")
		return nil, cs.initErr
	}

	if current.Endpoint == "" {
		cs.initErr = errors.New("cloud secrets not configured: endpoint not set")
		return nil, cs.initErr
	}

	extra := 2 // always: URL template + Authorization header
	if current.ResponsePath != "" {
		extra = 3
	}
	envCopy := make(map[string]string, len(cs.params.Environment)+extra)
	maps.Copy(envCopy, cs.params.Environment)
	envCopy["K6_SECRET_SOURCE_URL_URL_TEMPLATE"] = current.Endpoint
	envCopy["K6_SECRET_SOURCE_URL_HEADER_AUTHORIZATION"] = "Bearer " + current.Token
	if current.ResponsePath != "" {
		envCopy["K6_SECRET_SOURCE_URL_RESPONSE_PATH"] = current.ResponsePath
	}

	p := cs.params
	p.Environment = envCopy
	cs.urlSource, cs.initErr = url.New(p)

View on GitHub (pinned to 93accf6570)

Solutions

Set K6_CLOUD_SECRETS_ENDPOINT (together with the token), e.g. https://cloudapi.k6.io/v1/secrets
Double-check the exact variable spelling against the docs: K6_CLOUD_SECRETS_ENDPOINT
Source all relevant env files in the same shell/CI step that launches k6

Example fix

# before
export K6_CLOUD_SECRETS_TOKEN=$CLOUD_TOKEN
# endpoint missing -> error

# after
export K6_CLOUD_SECRETS_TOKEN=$CLOUD_TOKEN
export K6_CLOUD_SECRETS_ENDPOINT=https://cloudapi.k6.io/v1/secrets

Defensive patterns

Strategy: validation

Validate before calling

[ -n "${K6_CLOUD_SECRETS_ENDPOINT:-}" ] || { echo 'K6_CLOUD_SECRETS_ENDPOINT is empty'; exit 1; }

Prevention

Set token and endpoint in one env block so they are never split
Pin the endpoint per environment in a single sourced file
Check exact spelling: K6_CLOUD_SECRETS_ENDPOINT (not _URL)

When it happens

Trigger: K6_CLOUD_SECRETS_TOKEN set without K6_CLOUD_SECRETS_ENDPOINT; a partially-injected secrets config in the environment; the endpoint env var name misspelled (e.g. K6_CLOUD_SECRETS_URL) so it resolves to unset.

Common situations: Credential-first provisioning scripts that set the token but derive the endpoint from a variable that failed to expand; environments split across multiple env files where only one was sourced; documentation drift on the exact env var name.

Related errors

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/09a5810943949297. Report an issue: GitHub.