{"record":{"id":"0cd43c060f0321cb","repo":"nats-io/nats-server","slug":"operators-do-not-allow-accounts-to-be-configured-d","errorCode":null,"errorMessage":"operators do not allow Accounts to be configured directly","messagePattern":"operators do not allow Accounts to be configured directly","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/jwt.go","lineNumber":95,"sourceCode":"\t}\n\tif o.DefaultSentinel != _EMPTY_ {\n\t\tjuc, err := jwt.DecodeUserClaims(o.DefaultSentinel)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"default sentinel JWT not valid\")\n\t\t}\n\n\t\tif !juc.BearerToken && juc.IssuerAccount != \"\" && juc.HasEmptyPermissions() {\n\t\t\t// we cannot resolve the account yet - but this looks like a scoped user\n\t\t\t// it will be rejected at runtime if not valid\n\t\t} else if !juc.BearerToken {\n\t\t\treturn fmt.Errorf(\"default sentinel must be a bearer token\")\n\t\t}\n\t}\n\tif o.AccountResolver == nil {\n\t\treturn fmt.Errorf(\"operators require an account resolver to be configured\")\n\t}\n\tif len(o.Accounts) > 0 {\n\t\treturn fmt.Errorf(\"operators do not allow Accounts to be configured directly\")\n\t}\n\tif len(o.Users) > 0 || len(o.Nkeys) > 0 {\n\t\treturn fmt.Errorf(\"operators do not allow users to be configured directly\")\n\t}\n\tif len(o.TrustedOperators) > 0 && len(o.TrustedKeys) > 0 {\n\t\treturn fmt.Errorf(\"conflicting options for 'TrustedKeys' and 'TrustedOperators'\")\n\t}\n\tif o.SystemAccount != _EMPTY_ {\n\t\tfoundSys := false\n\t\tfoundNonEmpty := false\n\t\tfor _, op := range o.TrustedOperators {\n\t\t\tif op.SystemAccount != _EMPTY_ {\n\t\t\t\tfoundNonEmpty = true\n\t\t\t}\n\t\t\tif op.SystemAccount == o.SystemAccount {\n\t\t\t\tfoundSys = true\n\t\t\t\tbreak\n\t\t\t}","sourceCodeStart":77,"sourceCodeEnd":113,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jwt.go#L77-L113","documentation":"In operator mode, accounts are defined by account JWTs resolved via the AccountResolver, not by the config file. This error is thrown when `accounts` entries appear in a config that also sets an operator, since static account definitions conflict with decentralized JWT account management.","triggerScenarios":"Config contains both `operator: <jwt>` and an `accounts: {...}` block; validateOptions rejects it at startup.","commonSituations":"Migrating an existing nats-server config from account/user mode to operator mode and leaving the old accounts block in place; merging sample operator configs with legacy account configs.","solutions":["Remove the `accounts` block from the config and serve account JWTs through the resolver (resolver_preload / directory / URL)","If static accounts are actually required, remove the `operator` setting to stay in classic mode"],"exampleFix":"// before\noperator: eyJ...\naccounts: { A: { users: [...] } }\n// after\noperator: eyJ...\nresolver: MEMORY\nresolver_preload: { AD...: eyJ... }","handlingStrategy":"validation","validationCode":"// Go: reject mixed operator/static account config\nif len(o.TrustedOperators) > 0 && len(o.Accounts) > 0 {\n    return fmt.Errorf(\"accounts must come from the resolver in operator mode\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Strip accounts/users/nkeys blocks when migrating to operator mode","Serve accounts via resolver_preload or nsc-generated account JWTs","Lint configs to forbid `accounts` when `operator` is present"],"tags":["nats","jwt","config-validation","operator-mode"],"backgroundTag":"conflicting-config-options","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}