{"record":{"id":"51fbd5d94264478c","repo":"nats-io/nats-server","slug":"pinned-account-key-q-is-not-a-valid-public-accoun","errorCode":null,"errorMessage":"pinned account key %q is not a valid public account nkey","messagePattern":"pinned account key %q is not a valid public account nkey","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/jwt.go","lineNumber":165,"sourceCode":"\t// has a DidSign(). Use that longer term. For now we can expand in place.\n\tfor _, opc := range o.TrustedOperators {\n\t\tif o.TrustedKeys == nil {\n\t\t\to.TrustedKeys = make([]string, 0, 4)\n\t\t}\n\t\tif !opc.StrictSigningKeyUsage {\n\t\t\to.TrustedKeys = append(o.TrustedKeys, opc.Subject)\n\t\t}\n\t\to.TrustedKeys = append(o.TrustedKeys, opc.SigningKeys...)\n\t}\n\tfor _, key := range o.TrustedKeys {\n\t\tif !nkeys.IsValidPublicOperatorKey(key) {\n\t\t\treturn fmt.Errorf(\"trusted Keys %q are required to be a valid public operator nkey\", key)\n\t\t}\n\t}\n\tif len(o.resolverPinnedAccounts) > 0 {\n\t\tfor key := range o.resolverPinnedAccounts {\n\t\t\tif !nkeys.IsValidPublicAccountKey(key) {\n\t\t\t\treturn fmt.Errorf(\"pinned account key %q is not a valid public account nkey\", key)\n\t\t\t}\n\t\t}\n\t\t// ensure the system account (belonging to the operator can always connect)\n\t\tif o.SystemAccount != _EMPTY_ {\n\t\t\to.resolverPinnedAccounts[o.SystemAccount] = struct{}{}\n\t\t}\n\t}\n\n\t// If we have an auth callout defined make sure we are not in operator mode.\n\tif o.AuthCallout != nil {\n\t\treturn errors.New(\"operators do not allow authorization callouts to be configured directly\")\n\t}\n\n\treturn nil\n}\n\nfunc validateSrc(claims *jwt.UserClaims, host string) bool {\n\tif claims == nil {","sourceCodeStart":147,"sourceCodeEnd":183,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jwt.go#L147-L183","documentation":"Options validation for resolver pinned accounts: a key in resolverPinnedAccounts failed nkeys.IsValidPublicAccountKey, so it cannot be used to pin which accounts the resolver will fetch.","triggerScenarios":"Thrown at server/jwt.go:165 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Use valid 'A'-prefixed account public keys in the pinned accounts list","Remove mistyped keys from resolver_pinned_accounts","Regenerate keys with nkeys if corrupted"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}