{"record":{"id":"4add8ab66dc79ca7","repo":"nats-io/nats-server","slug":"proxy-trusted-key-q-is-invalid","errorCode":null,"errorMessage":"proxy trusted key %q is invalid","messagePattern":"proxy trusted key %q is invalid","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth.go","lineNumber":1803,"sourceCode":"\t\t}\n\t}\n\tfor _, u := range o.Nkeys {\n\t\tif u.Nkey == noAuthUser {\n\t\t\treturn nil\n\t\t}\n\t}\n\treturn fmt.Errorf(\n\t\t`no_auth_user: \"%s\" not present as user or nkey in authorization block or account configuration`,\n\t\tnoAuthUser)\n}\n\nfunc validateProxies(o *Options) error {\n\tif o.Proxies == nil {\n\t\treturn nil\n\t}\n\tfor _, p := range o.Proxies.Trusted {\n\t\tif !nkeys.IsValidPublicKey(p.Key) {\n\t\t\treturn fmt.Errorf(\"proxy trusted key %q is invalid\", p.Key)\n\t\t}\n\t}\n\treturn nil\n}\n\n// Create a list of nkeys.KeyPair corresponding to the public keys\n// of the Proxies.TrustedKeys list.\n// Server lock must be held on entry.\nfunc (s *Server) processProxiesTrustedKeys() {\n\t// We could be here on reload.\n\tif s.proxiesKeyPairs != nil {\n\t\ts.proxiesKeyPairs = s.proxiesKeyPairs[:0]\n\t}\n\tif opts := s.getOpts(); opts.Proxies == nil {\n\t\treturn\n\t}\n\tfor _, p := range s.getOpts().Proxies.Trusted {\n\t\t// Can't fail since we have already checked that it was a valid key.","sourceCodeStart":1785,"sourceCodeEnd":1821,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth.go#L1785-L1821","documentation":"A trusted public key configured for proxies failed nkeys.IsValidPublicKey validation. Proxy trusted keys are ed25519-based NATS nkeys; the server validates each entry at startup to ensure proxy trust anchors are well-formed 56-character base32 keys beginning with a valid prefix.","triggerScenarios":"validateProxies iterates o.Proxies.Trusted and a Key value is not a valid nkey — wrong length, invalid base32 characters, wrong prefix, or an empty string.","commonSituations":"Copy/paste truncated keys, quoting errors in config, using a seed (starting with 'S') instead of the public key, or using an account/user nkey of the wrong kind where a proxy trust key is expected.","solutions":["Regenerate or re-copy the proxy trusted public nkey ensuring it is the full 56-character public key (starts with a valid nkey prefix).","Ensure you are using the public key, not the seed (S-prefixed) key.","Check the config for truncation, whitespace, or quoting issues.","Validate keys with `nkeys` CLI or a quick nkeys.IsValidPublicKey check before adding to config."],"exampleFix":"// before\nproxies { trusted: [ { key: \"AB2C3D...\" } ] }\n// after\nproxies { trusted: [ { key: \"XB2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0U1V2W3X4Y5Z6A7B\" } ] }","handlingStrategy":"validation","validationCode":"for _, p := range opts.Proxies.Trusted {\n    if !nkeys.IsValidPublicKey(p.Key) {\n        return fmt.Errorf(\"invalid proxy key %q\", p.Key)\n    }\n}","typeGuard":"func isValidProxyKey(k string) bool { return nkeys.IsValidPublicKey(k) }","tryCatchPattern":"if err := validateOptions(opts); err != nil {\n    if strings.Contains(err.Error(), \"proxy trusted key\") {\n        log.Fatalf(\"fix proxy trusted nkey: %v\", err)\n    }\n}","preventionTips":["Copy full 56-char public keys, never seeds","Validate keys with the nkeys CLI before config edit","Avoid manual truncation when pasting into configs","Track key rotations in config management"],"tags":["config","nkeys","proxy","validation"],"backgroundTag":"invalid-nkey","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}