{"record":{"id":"61f8b6d7829cb4f5","repo":"nats-io/nats-server","slug":"can-not-have-a-single-nkey-and-a-users-array","errorCode":null,"errorMessage":"can not have a single nkey and a users array","messagePattern":"can not have a single nkey and a users array","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/leafnode.go","lineNumber":379,"sourceCode":"\t\t} else {\n\t\t\treturn fmt.Errorf(\"the minimum version should be at least 2.8.0\")\n\t\t}\n\t}\n\treturn nil\n}\n\n// Used to validate user names in LeafNode configuration.\n// - rejects mix of single and multiple users.\n// - rejects duplicate user names.\nfunc validateLeafNodeAuthOptions(o *Options) error {\n\tif len(o.LeafNode.Users) == 0 {\n\t\treturn nil\n\t}\n\tif o.LeafNode.Username != _EMPTY_ {\n\t\treturn fmt.Errorf(\"can not have a single user/pass and a users array\")\n\t}\n\tif o.LeafNode.Nkey != _EMPTY_ {\n\t\treturn fmt.Errorf(\"can not have a single nkey and a users array\")\n\t}\n\tusers := map[string]struct{}{}\n\tfor _, u := range o.LeafNode.Users {\n\t\tif _, exists := users[u.Username]; exists {\n\t\t\treturn fmt.Errorf(\"duplicate user %q detected in leafnode authorization\", u.Username)\n\t\t}\n\t\tusers[u.Username] = struct{}{}\n\t}\n\treturn nil\n}\n\nfunc validateLeafNodeProxyOptions(remote *RemoteLeafOpts) ([]string, error) {\n\tvar warnings []string\n\n\tif remote.Proxy.URL == _EMPTY_ {\n\t\treturn warnings, nil\n\t}\n","sourceCodeStart":361,"sourceCodeEnd":397,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/leafnode.go#L361-L397","documentation":"validateLeafNodeAuthOptions also rejects combining the single Nkey form with a Users array; if Users is non-empty and LeafNode.Nkey is set, this error is thrown. Like the user/pass variant, it exists because the two auth forms are mutually exclusive in leafnode configuration.","triggerScenarios":"Options where o.LeafNode.Users has >= 1 entry and o.LeafNode.Nkey != \"\" — e.g. a leafnode block with both `nkey:` and a `users:` array; raised via validateLeafNode or parseLeafNodes.","commonSituations":"Adding a users array for multiple remotes while the original single nkey line was left behind; scripted config generation that always emits an nkey template plus dynamic users.","solutions":["Remove the single `nkey:` key and keep only the users array (users can themselves have nkey entries)","Or remove the users array and keep the single nkey","Validate with `nats-server -t` before restart"],"exampleFix":"// before\nleafnodes {\n  nkey: \"ND...\"\n  users = [ { user: \"a\", pass: \"p\" } ]\n}\n// after\nleafnodes {\n  users = [ { nkey: \"ND...\" } ]\n}","handlingStrategy":"validation","validationCode":"if len(cfg.LeafNodes.Users) > 0 && cfg.LeafNodes.Nkey != \"\" {\n  return errors.New(\"use either single nkey or users array, not both\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Express single nkeys as a one-element users array","Avoid templates that always emit nkey plus users","Validate config before restart"],"tags":["leafnode","auth","nkey","config-validation"],"backgroundTag":"conflicting-auth-config","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}