{"record":{"id":"4f63e4c358fd19e3","repo":"risingwavelabs/risingwave","slug":"nats-connect-mode-credential-requires-both-nkey","errorCode":null,"errorMessage":"NATS connect mode `credential` requires both `nkey` and `jwt`","messagePattern":"NATS connect mode `credential` requires both `nkey` and `jwt`","errorType":"validation","errorClass":"ConnectorError","httpStatus":null,"severity":"error","filePath":"src/connector/src/connector_common/common.rs","lineNumber":1067,"sourceCode":"                if let (Some(v_user), Some(v_password)) =\n                    (self.user.as_ref(), self.password.as_ref())\n                {\n                    connect_options =\n                        connect_options.user_and_password(v_user.into(), v_password.into())\n                } else {\n                    bail!(\n                        \"NATS connect mode `user_and_password` requires both `user` and `password`\"\n                    );\n                }\n            }\n\n            \"credential\" => {\n                if let (Some(v_nkey), Some(v_jwt)) = (self.nkey.as_ref(), self.jwt.as_ref()) {\n                    connect_options = connect_options\n                        .credentials(&self.create_credential(v_nkey, v_jwt)?)\n                        .expect(\"failed to parse static creds\")\n                } else {\n                    bail!(\"NATS connect mode `credential` requires both `nkey` and `jwt`\");\n                }\n            }\n            \"plain\" => {}\n            _ => {\n                bail!(\n                    \"NATS connect mode must be one of `user_and_password`, `credential`, or `plain`\"\n                );\n            }\n        };\n\n        let servers = self.server_url.split(',').collect::<Vec<&str>>();\n        let client = connect_options\n            .connect(\n                servers\n                    .iter()\n                    .map(|url| url.parse())\n                    .collect::<Result<Vec<async_nats::ServerAddr>, _>>()?,\n            )","sourceCodeStart":1049,"sourceCodeEnd":1085,"githubUrl":"https://github.com/risingwavelabs/risingwave/blob/6469eb736d691e8e9b8a419a57edd6429ca77417/src/connector/src/connector_common/common.rs#L1049-L1085","documentation":"Thrown in the NATS connect-options builder when `connect_mode = 'credential'` is selected but either `nkey` or `jwt` (or both) is absent. Static NATS credentials are composed of both an nkey and a JWT account token; one without the other is unusable.","triggerScenarios":"Configuring a NATS source/sink with `connect_mode = 'credential'` while omitting `nkey` or `jwt` from the properties.","commonSituations":"Only the JWT was provisioned from the NATS operator and the nkey forgotten; secrets mounted partially; confusing `credential` mode with `user_and_password` mode fields.","solutions":["Provide both `nkey` and `jwt` fields in the connector properties.","Generate the pair via `nsc` (e.g. `nsc generate creds`) and supply both parts as secrets.","If you meant username/password auth, switch `connect_mode = 'user_and_password'` instead."],"exampleFix":"// before\nWITH (connect_mode = 'credential', jwt = 'eyJ...') -- nkey missing\n// after\nWITH (connect_mode = 'credential', nkey = 'UD...', jwt = 'eyJ...')","handlingStrategy":"validation","validationCode":"function validateNatsCredMode(props) {\n  if (props.connect_mode === 'credential') {\n    if (!props.nkey || !props.jwt) throw new Error('credential mode requires both nkey and jwt');\n  }\n}\nvalidateNatsCredMode(withOptions);","typeGuard":"const hasNkeyJwt = (p) => typeof p.nkey === 'string' && p.nkey.length > 0 && typeof p.jwt === 'string' && p.jwt.length > 0;","tryCatchPattern":"try { await createNatsSink(opts); } catch (e) { if (String(e).includes('requires both `nkey` and `jwt`')) throw new Error('Provide both nkey and jwt (nsc generate creds) for connect_mode = credential'); throw e; }","preventionTips":["Generate nkey and jwt as a pair via `nsc generate creds` and store them together.","Mount both values in one secret to keep them in sync.","Do not mix credential-mode fields with user_and_password fields."],"tags":["nats","authentication","config","validation"],"backgroundTag":"missing-required-config-field","analyzedSha":"6469eb736d691e8e9b8a419a57edd6429ca77417","analyzedAt":"2026-09-11T21:06:21.487Z","contentChangedAt":"2026-09-11T21:06:21.487Z","schemaVersion":2},"datasetVersion":"2026-09-14T16:17:12.679Z"}