{"record":{"id":"0b86b1647516d896","repo":"nats-io/nats-server","slug":"store-operation-not-supported-for-url-resolver","errorCode":null,"errorMessage":"store operation not supported for URL Resolver","messagePattern":"store operation not supported for URL Resolver","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/accounts.go","lineNumber":4190,"sourceCode":"}\n\nfunc (*resolverDefaultsOpsImpl) IsTrackingUpdate() bool {\n\treturn false\n}\n\nfunc (*resolverDefaultsOpsImpl) Start(*Server) error {\n\treturn nil\n}\n\nfunc (*resolverDefaultsOpsImpl) Reload() error {\n\treturn nil\n}\n\nfunc (*resolverDefaultsOpsImpl) Close() {\n}\n\nfunc (*resolverDefaultsOpsImpl) Store(_, _ string) error {\n\treturn fmt.Errorf(\"store operation not supported for URL Resolver\")\n}\n\n// MemAccResolver is a memory only resolver.\n// Mostly for testing.\ntype MemAccResolver struct {\n\tsm sync.Map\n\tresolverDefaultsOpsImpl\n}\n\n// Fetch will fetch the account jwt claims from the internal sync.Map.\nfunc (m *MemAccResolver) Fetch(name string) (string, error) {\n\tif j, ok := m.sm.Load(name); ok {\n\t\treturn j.(string), nil\n\t}\n\treturn _EMPTY_, ErrMissingAccount\n}\n\n// Store will store the account jwt claims in the internal sync.Map.","sourceCodeStart":4172,"sourceCodeEnd":4208,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/accounts.go#L4172-L4208","documentation":"The default resolver ops used with URL-based account resolvers are read-only: a URL resolver fetches JWTs over HTTP but cannot persist them. Any attempt to Store an account JWT through it returns this error unconditionally.","triggerScenarios":"Calling Store on resolverDefaultsOpsImpl, i.e. invoking the AccountResolver store path when the server is configured with a URL resolver (resolver: URL / resolver URL) rather than a memory resolver or full resolver with a store directory.","commonSituations":"Server started with 'resolver: URL(...)' but operator tooling or account-update publish path tries to push/update account claims via the resolver; config switch from memory resolver to URL resolver while tooling still calls Store.","solutions":["Use a memory resolver or directory-based resolver if JWTs must be stored/pushed to the server","With a URL resolver, serve updated JWTs from the HTTP endpoint instead of pushing them to the server","Gate the store call: only attempt Store when the resolver supports it"],"exampleFix":"// before\n// server.conf: resolver: URL(http://localhost/acc/)  + tooling calls Store\n// after\n// server.conf: resolver: MEMORY (or resolver dir) if you need Store, or serve updated JWTs at the URL endpoint","handlingStrategy":"validation","validationCode":"if _, isURL := resolver.(*URLAccResolver); isURL {\n    return errors.New(\"URL resolver is read-only; serve updated JWTs from the HTTP endpoint instead\")\n}\nif err := resolver.Store(name, jwt); err != nil { ... }\n","typeGuard":null,"tryCatchPattern":"if err := resolver.Store(name, jwt); err != nil {\n    if strings.Contains(err.Error(), \"store operation not supported\") {\n        // fall back to serving JWTs via the URL endpoint\n    }\n}\n","preventionTips":["Match resolver type to tooling: use memory/dir resolver when pushing JWTs","Document that URL resolvers are fetch-only","Switch config deliberately before enabling push tooling"],"tags":["nats-server","account-resolver","url-resolver","configuration"],"backgroundTag":"resolver-store-unsupported","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}