grafana/k6 · error

failed to initialize cloud secret source

Error message

failed to initialize cloud secret source: %w

What it means

When K6_CLOUD_SECRETS_TOKEN is set in the environment and no cloud secret source was registered yet, k6 constructs one with cloudsecrets.New(baseParams). If that constructor fails, the cause is wrapped as 'failed to initialize cloud secret source: <cause>' — the text after the colon is the real reason. The cloud source (and its SetConfig with token/endpoint/response-path) is only wired up after successful construction.

Solutions

1. Read the ': <cause>' suffix — fix whatever the wrapped constructor error names
2. If you did not intend to use cloud secrets, unset the variables: unset K6_CLOUD_SECRETS_TOKEN K6_CLOUD_SECRETS_ENDPOINT K6_CLOUD_SECRETS_RESPONSE_PATH
3. If you do use them, correct the related env vars (token present, endpoint URL well-formed) and rerun
4. For managed cloud runs prefer 'k6 cloud run --local-execution', which injects the cloud source automatically

Example fix

# before
export K6_CLOUD_SECRETS_TOKEN=tok
k6 run script.js   # fails to initialize cloud secret source

# after
unset K6_CLOUD_SECRETS_TOKEN K6_CLOUD_SECRETS_ENDPOINT K6_CLOUD_SECRETS_RESPONSE_PATH
k6 run script.js

# preflight: know whether cloud-secret env vars are present
if [ -n "${K6_CLOUD_SECRETS_TOKEN:-}" ]; then
  echo "K6_CLOUD_SECRETS_TOKEN is set — cloud secret source will be initialized" >&2
  # unset if unintended:
  # unset K6_CLOUD_SECRETS_TOKEN K6_CLOUD_SECRETS_ENDPOINT K6_CLOUD_SECRETS_RESPONSE_PATH
fi
k6 run script.js

When it happens

Trigger: Exporting K6_CLOUD_SECRETS_TOKEN (even accidentally, e.g. from a CI base image or stale shell profile) in an environment where the cloud secret source constructor rejects its params; the wrapped error names the exact parameter/config problem.

Common situations: CI images that pre-set all K6_CLOUD_SECRETS_* variables; local shells with leftover exports from a previous cloud experiment; partially migrated configs (token set, endpoint malformed).

Related errors

• 104
• both K6_CLOUD_METRICS_PUSH_URL and K6_CLOUD_TEST_RUN_TOKEN…
• can't have two secret sources that are default ones, second…
• couldn't parse secret source configuration
• env var ' ' is not a valid boolean value

AI-assisted analysis of grafana/k6@8d06114777 (2026-08-18). Data as JSON: /api/errors/50ad6e1e3334a30d. Report an issue: GitHub.

Appendix: source

Thrown at internal/cmd/root.go:560

	if len(result) == 1 {
		for _, l := range result {
			result["default"] = l
		}
	}

	// Capture the cloud source instance if it was registered (via local-execution auto-injection
	// or the env-var path below), so createCloudTest can call SetConfig on it later.
	if cs, ok := result["cloud"].(*cloudsecrets.SecretSource); ok {
		gs.CloudSecretSource = cs
	}

	// When  K6_CLOUD_SECRETS_TOKEN + K6_CLOUD_SECRETS_ENDPOINT are injected, create and configure the cloud source
	// directly from env vars without a /v1/tests round-trip. Set it as the default source if none was chosen.
	if token := gs.Env["K6_CLOUD_SECRETS_TOKEN"]; token != "" {
		if gs.CloudSecretSource == nil {
			cloudSource, err := cloudsecrets.New(baseParams)
			if err != nil {
				return nil, fmt.Errorf("failed to initialize cloud secret source: %w", err)
			}
			result["cloud"] = cloudSource
			gs.CloudSecretSource = cloudSource
		}
		gs.CloudSecretSource.SetConfig(&cloudsecrets.Config{
			Token:        token,
			Endpoint:     gs.Env["K6_CLOUD_SECRETS_ENDPOINT"],
			ResponsePath: gs.Env["K6_CLOUD_SECRETS_RESPONSE_PATH"],
		})
		if _, ok := result["default"]; !ok {
			result["default"] = gs.CloudSecretSource
		}
	}

	return result, nil
}

// isCloudRunWithLocalExecution returns true when the command being executed is

View on GitHub (pinned to 8d06114777)