{"record":{"id":"4e5cfc50f2d9e18a","repo":"nats-io/nats-server","slug":"will-only-fetch-valid-account-keys","errorCode":null,"errorMessage":"will only fetch valid account keys","messagePattern":"will only fetch valid account keys","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/accounts.go","lineNumber":4151,"sourceCode":"\t}\n\n\t// Now check for permissions.\n\tvar p = buildPermissionsFromJwt(&uc.Permissions)\n\tif p == nil {\n\t\tnu.defaultPerms = true\n\t\tacc.mu.RLock()\n\t\tif acc.defaultPerms != nil {\n\t\t\tp = acc.defaultPerms.clone()\n\t\t}\n\t\tacc.mu.RUnlock()\n\t}\n\tnu.Permissions = p\n\treturn nu\n}\n\nfunc fetchAccount(res AccountResolver, name string) (string, error) {\n\tif !nkeys.IsValidPublicAccountKey(name) {\n\t\treturn _EMPTY_, fmt.Errorf(\"will only fetch valid account keys\")\n\t}\n\treturn res.Fetch(copyString(name))\n}\n\n// AccountResolver interface. This is to fetch Account JWTs by public nkeys\ntype AccountResolver interface {\n\tFetch(name string) (string, error)\n\tStore(name, jwt string) error\n\tIsReadOnly() bool\n\tStart(server *Server) error\n\tIsTrackingUpdate() bool\n\tReload() error\n\tClose()\n}\n\n// Default implementations of IsReadOnly/Start so only need to be written when changed\ntype resolverDefaultsOpsImpl struct{}\n","sourceCodeStart":4133,"sourceCodeEnd":4169,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/accounts.go#L4133-L4169","documentation":"fetchAccount resolves an account JWT by account public key (nkey). Before calling the resolver it validates the name with nkeys.IsValidPublicAccountKey; anything that is not a valid 'A...' public account key is rejected with this error and never hits the resolver.","triggerScenarios":"Calling fetchAccount (e.g. through an AccountResolver such as URLAccResolver or MemAccResolver) with a name that is empty, a user/operator nkey, an email, or any string that is not a valid public account nkey.","commonSituations":"Resolver configured with wrong account name in config; caller passes account name/alias instead of the public key; stale or corrupted account reference in operator tooling.","solutions":["Ensure the account ID used is a valid public account nkey (starts with 'A', 57 chars, valid nkeys checksum)","Fix the account name in config/claims that triggers the resolver lookup","Pre-validate with nkeys.IsValidPublicAccountKey before calling the resolver"],"exampleFix":"// before\njwt, err := fetchAccount(resolver, \"my-account\")\n// after\nif !nkeys.IsValidPublicAccountKey(\"my-account\") {\n    return errors.New(\"account id must be a public account nkey\")\n}\njwt, err := fetchAccount(resolver, \"AB25...KEY\")","handlingStrategy":"validation","validationCode":"import \"github.com/nats-io/nkeys\"\nif !nkeys.IsValidPublicAccountKey(accountID) {\n    return fmt.Errorf(\"%q is not a valid public account key\", accountID)\n}\n","typeGuard":"func isPublicAccountKey(s string) bool { return nkeys.IsValidPublicAccountKey(s) }\n","tryCatchPattern":null,"preventionTips":["Store and pass account public nkeys, never names or emails","Validate keys at config load time","Distinguish account keys ('A' prefix) from user ('U')/operator ('O') keys"],"tags":["nats-server","account-resolver","nkeys","validation"],"backgroundTag":"invalid-account-nkey","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}