cloud secrets not configured: no secrets configuration avail

Error message

cloud secrets not configured: no secrets configuration available. Make sure you're using 'k6 cloud run --local-execution' and the cloud API returned secrets configuration

What it means

The default 'not configured' error from the Grafana Cloud k6 secret source when no push ref id is set and no secrets configuration arrived. The expected source of this configuration is the CreateTestRun API response during 'k6 cloud run --local-execution'; if the run is local-only ('k6 run') the cloud API is never called and the secret source has nothing to serve.

Source

Thrown at internal/secretsource/cloud/cloud.go:86

}

// Description returns a description of this secret source.
func (cs *SecretSource) Description() string {
	return "Grafana Cloud k6 secret source"
}

// notConfiguredError explains why no secrets configuration is available. When a test run is
// reused via the K6_CLOUD_PUSH_REF_ID env var, CreateTestRun is skipped (see #5814) so the
// config can't come from its response and must instead be supplied via the K6_CLOUD_SECRETS_*
// env vars; otherwise the generic 'k6 cloud run --local-execution' guidance applies (#6050).
func (cs *SecretSource) notConfiguredError() error {
	const prefix = "cloud secrets not configured: no secrets configuration available. "
	if cs.params.Environment["K6_CLOUD_PUSH_REF_ID"] != "" {
		return errors.New(prefix +
			"When an existing test run is reused via K6_CLOUD_PUSH_REF_ID, set " +
			"K6_CLOUD_SECRETS_TOKEN and K6_CLOUD_SECRETS_ENDPOINT to enable cloud secrets")
	}
	return errors.New(prefix +
		"Make sure you're using 'k6 cloud run --local-execution' and the cloud API " +
		"returned secrets configuration")
}

// ensureInitialized builds (or rebuilds) the URL source from configPtr.
func (cs *SecretSource) ensureInitialized() (secretsource.Source, error) {
	cs.mu.Lock()
	defer cs.mu.Unlock()

	current := cs.configPtr.Load()

	// Re-use the cached source if the config pointer is unchanged.
	if cs.activeCfg == current && (cs.urlSource != nil || cs.initErr != nil) {
		return cs.urlSource, cs.initErr
	}

	// (Re-)initialize for the new config.
	cs.activeCfg = current

View on GitHub (pinned to 93accf6570)

Solutions

Run via 'k6 cloud run --local-execution' so CreateTestRun returns the secrets configuration
For local dev, gate secret usage: fall back to env vars (__ENV) when cloud secrets are unavailable
Verify the cloud API actually returned secrets configuration for the test (check k6 debug logs / cloud UI test settings)

Example fix

// before
const apiKey = secret('api_key'); // fails on plain `k6 run`

// after
const apiKey = __ENV.K6_CLOUD_RUN ? secret('api_key') : __ENV.API_KEY;
// or always run with: k6 cloud run --local-execution script.js

Defensive patterns

Strategy: fallback

Validate before calling

# Before running, decide the mode explicitly:
if grep -q "secret(" script.js; then
  # secrets require cloud execution context
  exec k6 cloud run --local-execution script.js
fi
exec k6 run script.js

Prevention

Default scripts that use secret() to 'k6 cloud run --local-execution' in your task runner
Provide a local env-var fallback for every cloud secret used in dev
Alert on this error in CI so accidental plain 'k6 run' of cloud scripts is caught

When it happens

Trigger: Calling secret('name') in a plain 'k6 run' invocation without any cloud execution; running 'k6 cloud run' in a mode where the API response lacked secrets configuration; the cloud API not returning a secrets block for the test; a network/auth issue earlier that silently skipped config retrieval.

Common situations: Scripts with secret() calls run locally for debugging; CI that runs the same script both locally and in the cloud, failing only locally; tenants where the secrets feature is not enabled so the API response omits the config.

Related errors

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/2ad2360192c1eeb2. Report an issue: GitHub.