grafana/k6 · error

cloud secrets not configured: token not set

Error message

cloud secrets not configured: token not set

What it means

Returned while initializing the cloud secrets URL source when a secrets configuration exists but its Token field is empty. The token becomes the 'Authorization: Bearer <token>' header used to fetch secrets (envCopy["K6_SECRET_SOURCE_URL_HEADER_AUTHORIZATION"]), so an empty token means every fetch would be unauthorized; k6 fails fast instead.

Source

Thrown at internal/secretsource/cloud/cloud.go:114

	current := cs.configPtr.Load()

	// Re-use the cached source if the config pointer is unchanged.
	if cs.activeCfg == current && (cs.urlSource != nil || cs.initErr != nil) {
		return cs.urlSource, cs.initErr
	}

	// (Re-)initialize for the new config.
	cs.activeCfg = current
	cs.urlSource = nil
	cs.initErr = nil

	if current == nil {
		cs.initErr = cs.notConfiguredError()
		return nil, cs.initErr
	}

	if current.Token == "" {
		cs.initErr = errors.New("cloud secrets not configured: token not set")
		return nil, cs.initErr
	}

	if current.Endpoint == "" {
		cs.initErr = errors.New("cloud secrets not configured: endpoint not set")
		return nil, cs.initErr
	}

	extra := 2 // always: URL template + Authorization header
	if current.ResponsePath != "" {
		extra = 3
	}
	envCopy := make(map[string]string, len(cs.params.Environment)+extra)
	maps.Copy(envCopy, cs.params.Environment)
	envCopy["K6_SECRET_SOURCE_URL_URL_TEMPLATE"] = current.Endpoint
	envCopy["K6_SECRET_SOURCE_URL_HEADER_AUTHORIZATION"] = "Bearer " + current.Token
	if current.ResponsePath != "" {
		envCopy["K6_SECRET_SOURCE_URL_RESPONSE_PATH"] = current.ResponsePath

View on GitHub (pinned to 93accf6570)

Solutions

1. Set K6_CLOUD_SECRETS_TOKEN to a valid cloud token (the same style used for K6_CLOUD_TOKEN)
2. Verify the variable is non-empty at runtime: [ -n "$K6_CLOUD_SECRETS_TOKEN" ] || echo missing
3. Check the secret-injection step in CI actually resolved the value (no silent empty fallbacks)

Example fix

# before
export K6_CLOUD_SECRETS_ENDPOINT=https://cloudapi.k6.io/v1/secrets
export K6_CLOUD_SECRETS_TOKEN=""   # empty -> error

# after
export K6_CLOUD_SECRETS_ENDPOINT=https://cloudapi.k6.io/v1/secrets
export K6_CLOUD_SECRETS_TOKEN="$CLOUD_SECRETS_TOKEN"

[ -n "${K6_CLOUD_SECRETS_TOKEN:-}" ] || { echo 'K6_CLOUD_SECRETS_TOKEN is empty'; exit 1; }

When it happens

Trigger: K6_CLOUD_SECRETS_TOKEN exported as an empty string while K6_CLOUD_SECRETS_ENDPOINT is set; a secrets config JSON/struct with endpoint but blank token; CI secret masking that replaced the token with '' or a placeholder that later strips to empty.

Common situations: Vault/secret-manager integrations that inject an empty string when the secret path is wrong; shell quoting bugs (export K6_CLOUD_SECRETS_TOKEN="") in generated CI scripts; tokens stored under a differently-named variable that was never populated.

Related errors

• cloud secrets not configured: no secrets configuration avail
• cloud secrets not configured: endpoint not set
• access token not configured
• token value is required but it was not passed or is empty
• both K6_CLOUD_METRICS_PUSH_URL and K6_CLOUD_TEST_RUN_TOKEN m

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/f3b18dbdaee36388. Report an issue: GitHub.