windmill-labs/windmill · error

When --base-url is set, --token is required for protection-r

Error message

When --base-url is set, --token is required for protection-rules.

What it means

Pair-check in configureClientForWorkspace: --base-url was supplied without --token. Protection-rules supports stateless CI usage via explicit credentials, but only as a pair — a base URL alone gives no authentication, and the fallback profile lookup is skipped the moment --base-url is set. The input at fault is the CLI invocation missing --token.

Source

Thrown at cli/src/commands/protection-rules/file.ts:108

//   1. explicit --base-url + --token  -> used as-is (stateless CI; no profile
//      or wmill.yaml baseUrl required)
//   2. otherwise, the stored profile matching wmill.yaml workspaces.<ws>
//      (its baseUrl + token), with an explicit --token overriding the
//      stored token
//
// Throws a clean error if the key is unknown or nothing resolves it — callers
// decide whether to skip (--all) or fail (named arg).
export async function configureClientForWorkspace(
  opts: GlobalOptions,
  ws: string,
  resolver: WorkspaceResolver,
): Promise<string> {
  const wsId = resolver.backendId(ws); // throws if not in wmill.yaml

  // 1. Explicit credentials — honor them directly, like other commands do.
  if (opts.baseUrl) {
    if (!opts.token) {
      throw new Error(
        "When --base-url is set, --token is required for protection-rules.",
      );
    }
    setClient(opts.token, opts.baseUrl.replace(/\/+$/, ""));
    return wsId;
  }

  // 2. Stored-profile resolution. Fresh opts so resolveWorkspace's per-call
  // cache can't bleed across keys.
  const resolved = await tryResolveBranchWorkspace({ ...opts }, ws);
  if (!resolved) {
    throw new Error(
      `Could not resolve credentials for workspace '${ws}'. Either pass ` +
        `--base-url and --token, or ensure wmill.yaml workspaces.${ws} has a ` +
        `baseUrl and you've run 'wmill workspace add' for it.`,
    );
  }
  // An explicit --token overrides the stored profile's token.

View on GitHub (pinned to e474e8803c)

Solutions

1. Pass both: --base-url https://... --token <token>
2. Drop --base-url to fall back to the stored profile / wmill.yaml workspaces.<ws> baseUrl resolution

When it happens

Trigger: Thrown at cli/src/commands/protection-rules/file.ts:108 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of windmill-labs/windmill@e474e8803c (2026-09-03). Data as JSON: /api/errors/8f0d29904b1da39a. Report an issue: GitHub.