{"record":{"id":"11d16dd29e4fa58c","repo":"nats-io/nats-server","slug":"default-js-domain-contains-account-name-q-which","errorCode":null,"errorMessage":"default_js_domain contains account name %q, which is not a valid public account nkey","messagePattern":"default_js_domain contains account name %q, which is not a valid public account nkey","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/jetstream.go","lineNumber":2907,"sourceCode":"\t\t\t\t} else {\n\t\t\t\t\tfor _, acc := range o.Accounts {\n\t\t\t\t\t\tif a == acc.GetName() {\n\t\t\t\t\t\t\tif len(acc.jsLimits) > 0 && domain != _EMPTY_ {\n\t\t\t\t\t\t\t\treturn fmt.Errorf(\"default_js_domain contains account name %q with enabled JetStream\", a)\n\t\t\t\t\t\t\t}\n\t\t\t\t\t\t\tfound = true\n\t\t\t\t\t\t\tbreak\n\t\t\t\t\t\t}\n\t\t\t\t\t}\n\t\t\t\t}\n\t\t\t\tif !found {\n\t\t\t\t\treturn fmt.Errorf(\"in non operator mode, `default_js_domain` references non existing account %q\", a)\n\t\t\t\t}\n\t\t\t}\n\t\t} else {\n\t\t\tfor a := range o.JsAccDefaultDomain {\n\t\t\t\tif !nkeys.IsValidPublicAccountKey(a) {\n\t\t\t\t\treturn fmt.Errorf(\"default_js_domain contains account name %q, which is not a valid public account nkey\", a)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tfor a, d := range o.JsAccDefaultDomain {\n\t\t\tsacc := DEFAULT_SYSTEM_ACCOUNT\n\t\t\tif o.SystemAccount != _EMPTY_ {\n\t\t\t\tsacc = o.SystemAccount\n\t\t\t}\n\t\t\tif a == sacc {\n\t\t\t\treturn fmt.Errorf(\"system account %q can not be in default_js_domain\", a)\n\t\t\t}\n\t\t\tif d == _EMPTY_ {\n\t\t\t\tcontinue\n\t\t\t}\n\t\t\tif sub := fmt.Sprintf(jsDomainAPI, d); !IsValidSubject(sub) {\n\t\t\t\treturn fmt.Errorf(\"default_js_domain contains account %q with invalid domain name %q\", a, d)\n\t\t\t}\n\t\t}","sourceCodeStart":2889,"sourceCodeEnd":2925,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jetstream.go#L2889-L2925","documentation":"In operator mode (when an explicit system account name is not the default), accounts referenced in default_js_domain must be public account nkeys (N keys starting with 'A'). The server validates each key with nkeys.IsValidPublicAccountKey and rejects startup if an entry is not a valid public account key, since operator mode identifies accounts by nkey, not name.","triggerScenarios":"Operator-mode config where JsAccDefaultDomain keys are human-readable account names, bare IDs, or malformed nkeys instead of valid public account nkeys (e.g. 'AD...' style, 56 chars, base32).","commonSituations":"Using account names in default_js_domain in a leaf/operator deployment; copy-pasting a user nkey ('U...') or signing key instead of an account nkey; truncating the nkey in YAML.","solutions":["Replace each entry key with the account's public nkey (from the account JWT or `nsc list accounts`).","Validate keys with `nkeys` tooling or `nats account info` before adding.","Ensure keys are complete (56-char, 'A'-prefixed base32) and not user/server nkeys.","Run `nats-server -t` to validate config before restart."],"exampleFix":"// before\noperator mode:\ndefault_js_domain: { payments: \"domainA\" }\n// after\ndefault_js_domain: { AD7R4WtgNVy...public_nkey...: \"domainA\" }","handlingStrategy":"validation","validationCode":"for name := range cfg.DefaultJSDomain {\n    if !strings.HasPrefix(name, \"A\") || len(name) != 56 {\n        return fmt.Errorf(\"default_js_domain key %q is not a public account nkey\", name)\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Use `nsc list accounts` or account JWT issuer to copy exact nkeys","Never use account names, user nkeys (U...) or server nkeys (N...) in operator-mode mappings","Check key length/prefix (A..., 56 chars) before committing config","Run `nats-server -t` in CI for operator configs"],"tags":["jetstream","configuration","nkeys","operator-mode","nats-server"],"backgroundTag":"invalid-account-nkey","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}