{"record":{"id":"09b3278d7ee5793d","repo":"nats-io/nats-server","slug":"system-account-not-setup","errorCode":null,"errorMessage":"system account not setup","messagePattern":"system account not setup","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/errors.go","lineNumber":169,"sourceCode":"\n\t// ErrCycleSearchDepth is returned when we have exceeded our maximum search depth..\n\tErrCycleSearchDepth = errors.New(\"search cycle depth exhausted\")\n\n\t// ErrClientOrRouteConnectedToGatewayPort represents an error condition when\n\t// a client or route attempted to connect to the Gateway port.\n\tErrClientOrRouteConnectedToGatewayPort = errors.New(\"attempted to connect to gateway port\")\n\n\t// ErrWrongGateway represents an error condition when a server receives a connect\n\t// request from a remote Gateway with a destination name that does not match the server's\n\t// Gateway's name.\n\tErrWrongGateway = errors.New(\"wrong gateway\")\n\n\t// ErrGatewayNameHasSpaces signals that the gateway name contains spaces, which is not allowed.\n\tErrGatewayNameHasSpaces = errors.New(\"gateway name cannot contain spaces\")\n\n\t// ErrNoSysAccount is returned when an attempt to publish or subscribe is made\n\t// when there is no internal system account defined.\n\tErrNoSysAccount = errors.New(\"system account not setup\")\n\n\t// ErrRevocation is returned when a credential has been revoked.\n\tErrRevocation = errors.New(\"credentials have been revoked\")\n\n\t// ErrServerNotRunning is used to signal an error that a server is not running.\n\tErrServerNotRunning = errors.New(\"server is not running\")\n\n\t// ErrServerNameHasSpaces signals that the server name contains spaces, which is not allowed.\n\tErrServerNameHasSpaces = errors.New(\"server name cannot contain spaces\")\n\n\t// ErrBadMsgHeader signals the parser detected a bad message header\n\tErrBadMsgHeader = errors.New(\"bad message header detected\")\n\n\t// ErrMsgHeadersNotSupported signals the parser detected a message header\n\t// but they are not supported on this server.\n\tErrMsgHeadersNotSupported = errors.New(\"message headers not supported\")\n\n\t// ErrNoRespondersRequiresHeaders signals that a client needs to have headers","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/errors.go#L151-L187","documentation":"ErrNoSysAccount is returned when an operation requires the internal system account but none is set up on the server. Callers like account initialization (server/accounts.go:1291) and JetStream consumer/API helpers (server/consumer.go:1977) check `EventsEnabled()` (i.e., the system account and events are active) and return this sentinel when not. The message text is \"system account not setup\".","triggerScenarios":"Publishing/subscribing on behalf of the system account when the server has no `system_account` configured; requesting JetStream account info / consumer APIs that rely on internal system requests while events are disabled; single-node dev servers started without a system account.","commonSituations":"Running a server without `system_account` in config but enabling features (JetStream monitoring, account activity) that need it; embedded servers used in tests without system account setup; mixed clusters where some nodes lack the system account config.","solutions":["Configure a system account: add `system_account: <SYS_ACCOUNT_PUBKEY>` to the server config (typically from an operator-mode resolver setup).","Create the system account JWT if using operator/resolver mode (`nsc add account --name SYS` and push it).","For embedded/test servers, set the system account programmatically via options before starting.","Alternatively, disable the dependent feature (e.g. JetStream account monitoring) if no system account is intended."],"exampleFix":"// before: server.conf without system account\n// after\n// system_account: ADMBQSNVSE2TZTPNBSWXWFOTWU5GHOCQMX4BPH2QKJKBXU7NZ6HSYOWC","handlingStrategy":"validation","validationCode":"// Before using features that need the system account, verify it is configured:\n// nats server info  -> check system account fields, or in config ensure\n// `system_account` is present and the account JWT exists on the resolver.","typeGuard":null,"tryCatchPattern":"if _, err := js.AccountInfo(); err != nil {\n    if errors.Is(err, ErrNoSysAccount) {\n        // disable dependent features or configure the system account\n    }\n}","preventionTips":["Always set up the system account in operator/resolver deployments before enabling JetStream monitoring.","For embedded servers, programmatically configure the system account in tests.","Keep system account config identical across all cluster nodes.","Document which features depend on the system account for your platform team."],"tags":["nats","system-account","configuration","jetstream"],"backgroundTag":"system-account-not-configured","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}