Skip to content
Latchkey

CircleCI "circleci config validate" CLI Errors - Fix Local Lint

The circleci config validate CLI step fails or disagrees with what the server accepts. Usually the CLI is stale, private orbs need an org id and token, or local validation does not compile everything the server does.

What this error means

A CI lint step running circleci config validate errors even though the config runs fine (or vice versa). Private orb resolution fails locally, or the CLI reports a problem the server does not - a tooling mismatch, not always a real config bug.

Terminal
Error: Unable to resolve orb 'myorg/private-tools@1.2.3':
  authentication required (set --org-id and CIRCLECI_CLI_TOKEN)
# or
Error: config validate requires CLI >= 0.1.x; please update

Common causes

Stale or missing CLI

An outdated circleci CLI rejects valid 2.1 features or lacks newer validation. A fresh install/update fixes spurious errors.

Private orbs need org id and token

Validating a config that uses a private orb requires --org-id and a CIRCLECI_CLI_TOKEN; without them the orb cannot be resolved offline.

Local validate is not full server compilation

config validate does not always resolve everything the server compiles (e.g. some orb/parameter expansion). Use config process to mirror server behavior more closely.

How to fix it

Validate with an up-to-date CLI and org context

Terminal
circleci version
circleci update                       # refresh the CLI
export CIRCLECI_CLI_TOKEN=...          # for private orbs
circleci config validate --org-id "$ORG_ID" .circleci/config.yml

Mirror server compilation with config process

  1. Run circleci config process to fully expand orbs, commands, and parameters.
  2. Pass --org-id and a token so private orbs resolve.
  3. Pin the CLI version in CI so local and pipeline validation match.

How to prevent it

  • Keep the circleci CLI updated (and pinned in CI) for consistent validation.
  • Provide --org-id and a token when validating private-orb configs.
  • Use config process, not just validate, to catch expansion-time issues.

Related guides

Tired of flaky CI? Latchkey auto-heals failed jobs and retries them for you. Start free →