windmill-labs/windmill · error

Could not resolve credentials for workspace '${ws}'. Either

Error message

Could not resolve credentials for workspace '${ws}'. Either pass --base-url and --token, or ensure wmill.yaml workspaces.${ws} has a baseUrl and you've run 'wmill workspace add' for it.

What it means

Error "Could not resolve credentials for workspace '${ws}'. Either pass --base-url and --token, or ensure wmill.yaml workspaces.${ws} has a baseUrl and you've run 'wmill workspace add' for it." thrown in windmill-labs/windmill.

Source

Thrown at cli/src/commands/protection-rules/file.ts:120

): Promise<string> {
  const wsId = resolver.backendId(ws); // throws if not in wmill.yaml

  // 1. Explicit credentials — honor them directly, like other commands do.
  if (opts.baseUrl) {
    if (!opts.token) {
      throw new Error(
        "When --base-url is set, --token is required for protection-rules.",
      );
    }
    setClient(opts.token, opts.baseUrl.replace(/\/+$/, ""));
    return wsId;
  }

  // 2. Stored-profile resolution. Fresh opts so resolveWorkspace's per-call
  // cache can't bleed across keys.
  const resolved = await tryResolveBranchWorkspace({ ...opts }, ws);
  if (!resolved) {
    throw new Error(
      `Could not resolve credentials for workspace '${ws}'. Either pass ` +
        `--base-url and --token, or ensure wmill.yaml workspaces.${ws} has a ` +
        `baseUrl and you've run 'wmill workspace add' for it.`,
    );
  }
  // An explicit --token overrides the stored profile's token.
  setClient(opts.token ?? resolved.token, resolved.remote.replace(/\/+$/, ""));
  return wsId;
}

View on GitHub (pinned to e474e8803c)

Solutions

  1. Pass explicit --base-url and --token together for stateless/CI use
  2. Ensure wmill.yaml workspaces.<ws> declares the workspace's baseUrl and run 'wmill workspace add' for it to store a profile token
  3. Re-login (wmill login) if the stored token expired, then retry the protection-rules command
Defensive patterns

Strategy: fallback

When it happens

Trigger: Thrown at cli/src/commands/protection-rules/file.ts:120 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/341848b774435e4e. Report an issue: GitHub.