{"record":{"id":"5c357c312352603b","repo":"nats-io/nats-server","slug":"user-jwt-issuer-q-is-not-known","errorCode":null,"errorMessage":"user JWT issuer %q is not known","messagePattern":"user JWT issuer %q is not known","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth_callout.go","lineNumber":233,"sourceCode":"\n\t\t// if we are not in operator mode, they can specify placement as a tag\n\t\tvar placement string\n\t\tif !isOperatorMode {\n\t\t\t// only allow placement if we are not in operator mode\n\t\t\tplacement = arc.Audience\n\t\t} else {\n\t\t\tplacement = issuerAccount\n\t\t}\n\n\t\ttargetAcc, err := s.LookupAccount(placement)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"no valid account %q for auth callout response on account %q: %v\", placement, account, err)\n\t\t}\n\t\tif isOperatorMode {\n\t\t\t// this will validate the signing key that emitted the user, and if it is a signing\n\t\t\t// key it assigns the permissions from the target account\n\t\t\tif scope, ok := targetAcc.hasIssuer(arc.Issuer); !ok {\n\t\t\t\treturn nil, fmt.Errorf(\"user JWT issuer %q is not known\", arc.Issuer)\n\t\t\t} else if scope != nil {\n\t\t\t\t// this possibly has to be different because it could just be a plain issued by a non-scoped signing key\n\t\t\t\tif err := scope.ValidateScopedSigner(arc); err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"user JWT is not valid: %v\", err)\n\t\t\t\t} else if uSc, ok := scope.(*jwt.UserScope); !ok {\n\t\t\t\t\treturn nil, fmt.Errorf(\"user JWT is not a valid scoped user\")\n\t\t\t\t} else if arc.User.UserPermissionLimits, err = processUserPermissionsTemplate(uSc.Template, arc, targetAcc); err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"user JWT generated invalid permissions: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn targetAcc, nil\n\t}\n\n\tprocessReply := func(_ *subscription, rc *client, racc *Account, subject, reply string, rmsg []byte) {\n\t\tarc, err := decodeResponse(rc, rmsg, racc)\n\t\tif err != nil {\n\t\t\tc.authViolation()","sourceCodeStart":215,"sourceCodeEnd":251,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth_callout.go#L215-L251","documentation":"In operator mode, the server verified that the signing key that emitted the user JWT (arc.Issuer) is a known issuer on the target account via targetAcc.hasIssuer. The issuer is neither the account's identity key nor one of its signing keys, so the user JWT is rejected. Scoped signing keys are then validated further (see the following error).","triggerScenarios":"Operator-mode auth callout emits a user JWT signed by a key that is not registered as an issuer/signing key of the resolved target account, so hasIssuer(arc.Issuer) returns ok=false.","commonSituations":"Signing with a key from a different account; account JWT updated and an old signing key removed while the callout still uses it; callout misconfigured with the wrong private key.","solutions":["Sign the user JWT with the target account's identity key or one of its configured signing keys.","Add the key the callout uses to the target account JWT's signing keys list and re-push the account claim.","Audit key rotation: reconfigure the callout after signing keys are rotated."],"exampleFix":"// before\nsigned, err := arc.Encode(oldSigningKey) // removed from account signing keys\n// after\nsigned, err := arc.Encode(currentSigningKey) // listed in target account's signing_keys","handlingStrategy":"validation","validationCode":"// callout side: confirm the signing key is one of the target account's issuers\nif !accountSigningKeys.Contains(arc.Issuer) {\n    return fmt.Errorf(\"issuer %q is not a signing key of the target account\", arc.Issuer)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Sign user JWTs only with the target account's identity or listed signing keys.","Update the callout immediately after account signing-key rotation.","Store per-account signing keys explicitly in callout config."],"tags":["auth-callout","jwt","signing-key"],"backgroundTag":"jwt-unknown-issuer","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}