{"record":{"id":"23ed9dc314c16294","repo":"nats-io/nats-server","slug":"no-operator-key-found","errorCode":null,"errorMessage":"no operator key found","messagePattern":"no operator key found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/accounts.go","lineNumber":4427,"sourceCode":"\t}\n}\n\nfunc getOperatorKeys(s *Server) (string, map[string]struct{}, bool, error) {\n\tvar op string\n\tvar strict bool\n\tkeys := make(map[string]struct{})\n\tif opts := s.getOpts(); opts != nil && len(opts.TrustedOperators) > 0 {\n\t\top = opts.TrustedOperators[0].Subject\n\t\tstrict = opts.TrustedOperators[0].StrictSigningKeyUsage\n\t\tif !strict {\n\t\t\tkeys[opts.TrustedOperators[0].Subject] = struct{}{}\n\t\t}\n\t\tfor _, key := range opts.TrustedOperators[0].SigningKeys {\n\t\t\tkeys[key] = struct{}{}\n\t\t}\n\t}\n\tif len(keys) == 0 {\n\t\treturn _EMPTY_, nil, false, fmt.Errorf(\"no operator key found\")\n\t}\n\treturn op, keys, strict, nil\n}\n\nfunc claimValidate(claim *jwt.AccountClaims) error {\n\tvr := &jwt.ValidationResults{}\n\tclaim.Validate(vr)\n\tif vr.IsBlocking(false) {\n\t\treturn fmt.Errorf(\"validation errors: %v\", vr.Errors())\n\t}\n\treturn nil\n}\n\nfunc removeCb(s *Server, pubKey string) {\n\tv, ok := s.accounts.Load(pubKey)\n\tif !ok {\n\t\treturn\n\t}","sourceCodeStart":4409,"sourceCodeEnd":4445,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/accounts.go#L4409-L4445","documentation":"This error comes from the function that determines the operator public key, trusted signing keys, and strict-mode flag used by the JWT resolver setup. When no operator key can be derived — neither from TrustedOperators[0] signing keys nor any other configured source — it returns 'no operator key found', blocking account claim validation/updates.","triggerScenarios":"Starting/using a server with resolver-based account validation where opts.TrustedOperators is empty, or it exists but TrustedOperators[0].SigningKeys is empty, leaving the keys map empty.","commonSituations":"Operator JWT removed from the server config while resolver is still enabled; an operator claim without signing keys (operator signs everything itself and no explicit keys configured); upgrade/config migration dropping the operator block.","solutions":["Configure TrustedOperators in the server config with a claim that includes SigningKeys (or rely on the operator public key being the signing key).","Run `nsc generate config` / update operator JWT so the resolver operator has valid signing keys.","If not using JWT-based accounts, disable the resolver instead of leaving it half-configured."],"exampleFix":"// before\nresolver: MEMORY\n# no operator configured\n// after\nresolver: MEMORY\noperator: ./operator.jwt # operator claim with signing keys","handlingStrategy":"validation","validationCode":"// before starting the server / pushing claims:\nif len(opts.TrustedOperators) == 0 || len(opts.TrustedOperators[0].SigningKeys) == 0 {\n    return fmt.Errorf(\"no trusted operator signing keys configured\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Ship an operator JWT with signing keys in every server config","Validate server config with `nats-server -t` before deploy","Alert on resolver-enabled configs missing the operator block"],"tags":["nats","jwt","resolver","config"],"backgroundTag":"missing-operator-key","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}