CircleCI "circleci config validate" CLI Errors - Fix Local Lint
The circleci config validate CLI step fails or disagrees with what the server accepts. Usually the CLI is stale, private orbs need an org id and token, or local validation does not compile everything the server does.
What this error means
A CI lint step running circleci config validate errors even though the config runs fine (or vice versa). Private orb resolution fails locally, or the CLI reports a problem the server does not - a tooling mismatch, not always a real config bug.
Error: Unable to resolve orb 'myorg/private-tools@1.2.3':
authentication required (set --org-id and CIRCLECI_CLI_TOKEN)
# or
Error: config validate requires CLI >= 0.1.x; please updateCommon causes
Stale or missing CLI
An outdated circleci CLI rejects valid 2.1 features or lacks newer validation. A fresh install/update fixes spurious errors.
Private orbs need org id and token
Validating a config that uses a private orb requires --org-id and a CIRCLECI_CLI_TOKEN; without them the orb cannot be resolved offline.
Local validate is not full server compilation
config validate does not always resolve everything the server compiles (e.g. some orb/parameter expansion). Use config process to mirror server behavior more closely.
How to fix it
Validate with an up-to-date CLI and org context
circleci version
circleci update # refresh the CLI
export CIRCLECI_CLI_TOKEN=... # for private orbs
circleci config validate --org-id "$ORG_ID" .circleci/config.ymlMirror server compilation with config process
- Run
circleci config processto fully expand orbs, commands, and parameters. - Pass
--org-idand a token so private orbs resolve. - Pin the CLI version in CI so local and pipeline validation match.
How to prevent it
- Keep the
circleciCLI updated (and pinned in CI) for consistent validation. - Provide
--org-idand a token when validating private-orb configs. - Use
config process, not justvalidate, to catch expansion-time issues.