{"record":{"id":"1038288bf567c4fd","repo":"nats-io/nats-server","slug":"default-sentinel-must-be-a-bearer-token","errorCode":null,"errorMessage":"default sentinel must be a bearer token","messagePattern":"default sentinel must be a bearer token","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/jwt.go","lineNumber":88,"sourceCode":"func validateTrustedOperators(o *Options) error {\n\tif len(o.TrustedOperators) == 0 {\n\t\t// if we have no operator, default sentinel shouldn't be set\n\t\tif o.DefaultSentinel != _EMPTY_ {\n\t\t\treturn fmt.Errorf(\"default sentinel requires operators and accounts\")\n\t\t}\n\t\treturn nil\n\t}\n\tif o.DefaultSentinel != _EMPTY_ {\n\t\tjuc, err := jwt.DecodeUserClaims(o.DefaultSentinel)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"default sentinel JWT not valid\")\n\t\t}\n\n\t\tif !juc.BearerToken && juc.IssuerAccount != \"\" && juc.HasEmptyPermissions() {\n\t\t\t// we cannot resolve the account yet - but this looks like a scoped user\n\t\t\t// it will be rejected at runtime if not valid\n\t\t} else if !juc.BearerToken {\n\t\t\treturn fmt.Errorf(\"default sentinel must be a bearer token\")\n\t\t}\n\t}\n\tif o.AccountResolver == nil {\n\t\treturn fmt.Errorf(\"operators require an account resolver to be configured\")\n\t}\n\tif len(o.Accounts) > 0 {\n\t\treturn fmt.Errorf(\"operators do not allow Accounts to be configured directly\")\n\t}\n\tif len(o.Users) > 0 || len(o.Nkeys) > 0 {\n\t\treturn fmt.Errorf(\"operators do not allow users to be configured directly\")\n\t}\n\tif len(o.TrustedOperators) > 0 && len(o.TrustedKeys) > 0 {\n\t\treturn fmt.Errorf(\"conflicting options for 'TrustedKeys' and 'TrustedOperators'\")\n\t}\n\tif o.SystemAccount != _EMPTY_ {\n\t\tfoundSys := false\n\t\tfoundNonEmpty := false\n\t\tfor _, op := range o.TrustedOperators {","sourceCodeStart":70,"sourceCodeEnd":106,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jwt.go#L70-L106","documentation":"After successfully decoding DefaultSentinel, validateTrustedOperators requires it to be a bearer token: a JWT whose UserClaims have BearerToken set (no signature requirement / auth bypass semantics). If the claims are not a bearer token (juc.BearerToken is false and it does not qualify as an exempt scoped user), the server refuses to start with 'default sentinel must be a bearer token'.","triggerScenarios":"Configuring default_sentinel with a normal (non-bearer) user JWT — one carrying permissions requiring full claim verification — instead of a bearer-token user created for sentinel purposes.","commonSituations":"Generating the sentinel user with `nsc` without enabling bearer token (e.g. missing the bearer_token claim or not using `--bearer`); reusing an existing scoped user JWT as the sentinel.","solutions":["Create the sentinel as a bearer token user: with nsc add the user with bearer token enabled (bearer_token: true in the claims) and re-export the JWT.","Edit the user in nsc to set BearerToken, then regenerate/update default_sentinel in the config.","Alternatively, if a scoped user is intended, ensure it has an IssuerAccount and empty permissions so it is accepted as a scoped default user.","Restart the server and confirm startup passes validation."],"exampleFix":"// before: non-bearer user JWT in config\ndefault_sentinel: \"eyJ...\"  // bearer_token missing\n// after (nsc)\n$ nsc edit user sentinel --bearer\n$ nsc describe user sentinel --raw > sentinel.jwt\n// nats.conf\ndefault_sentinel: \"<contents of sentinel.jwt>\"","handlingStrategy":"validation","validationCode":"// Go: ensure the sentinel is a bearer token before configuring\nuc, err := jwt.DecodeUserClaims(sentinelJWT)\nif err != nil || !uc.BearerToken {\n    return errors.New(\"default_sentinel must be a bearer token user JWT\")\n}","typeGuard":"func isBearerSentinel(tok string) bool {\n    uc, err := jwt.DecodeUserClaims(tok)\n    return err == nil && uc.BearerToken\n}","tryCatchPattern":null,"preventionTips":["Create the sentinel user with bearer token enabled in nsc (`bearer_token: true`).","Check the decoded claims' BearerToken field before deploying.","Reuse a dedicated sentinel user, not a general scoped user JWT.","Run config validation as a pre-start gate in automation."],"tags":["config","authentication","jwt","bearer-token"],"backgroundTag":"jwt-not-bearer-token","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}