{"record":{"id":"666a25d478d5591f","repo":"nats-io/nats-server","slug":"operators-require-an-account-resolver-to-be-config","errorCode":null,"errorMessage":"operators require an account resolver to be configured","messagePattern":"operators require an account resolver to be configured","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/jwt.go","lineNumber":92,"sourceCode":"\t\t\treturn fmt.Errorf(\"default sentinel requires operators and accounts\")\n\t\t}\n\t\treturn nil\n\t}\n\tif o.DefaultSentinel != _EMPTY_ {\n\t\tjuc, err := jwt.DecodeUserClaims(o.DefaultSentinel)\n\t\tif err != nil {\n\t\t\treturn fmt.Errorf(\"default sentinel JWT not valid\")\n\t\t}\n\n\t\tif !juc.BearerToken && juc.IssuerAccount != \"\" && juc.HasEmptyPermissions() {\n\t\t\t// we cannot resolve the account yet - but this looks like a scoped user\n\t\t\t// it will be rejected at runtime if not valid\n\t\t} else if !juc.BearerToken {\n\t\t\treturn fmt.Errorf(\"default sentinel must be a bearer token\")\n\t\t}\n\t}\n\tif o.AccountResolver == nil {\n\t\treturn fmt.Errorf(\"operators require an account resolver to be configured\")\n\t}\n\tif len(o.Accounts) > 0 {\n\t\treturn fmt.Errorf(\"operators do not allow Accounts to be configured directly\")\n\t}\n\tif len(o.Users) > 0 || len(o.Nkeys) > 0 {\n\t\treturn fmt.Errorf(\"operators do not allow users to be configured directly\")\n\t}\n\tif len(o.TrustedOperators) > 0 && len(o.TrustedKeys) > 0 {\n\t\treturn fmt.Errorf(\"conflicting options for 'TrustedKeys' and 'TrustedOperators'\")\n\t}\n\tif o.SystemAccount != _EMPTY_ {\n\t\tfoundSys := false\n\t\tfoundNonEmpty := false\n\t\tfor _, op := range o.TrustedOperators {\n\t\t\tif op.SystemAccount != _EMPTY_ {\n\t\t\t\tfoundNonEmpty = true\n\t\t\t}\n\t\t\tif op.SystemAccount == o.SystemAccount {","sourceCodeStart":74,"sourceCodeEnd":110,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jwt.go#L74-L110","documentation":"This error is thrown by validateTrustedOperators in server/jwt.go when operator-mode (TrustedOperators) is configured but no AccountResolver is set. Operator mode relies on decentralized JWT authentication, so the server needs a resolver (memory, directory, or NATS-based) to look up account signing keys and account JWTs. Without it, operator mode cannot function, so server startup is aborted.","triggerScenarios":"Config file sets an 'operator' (TrustedOperators) but omits any 'resolver' setting; validateOptions fails before the server starts.","commonSituations":"Minimal operator-mode configs copied from docs that show the operator JWT but forget the resolver: e.g. `operator: <jwt>` with no `resolver: MEMORY` or `resolver: URL(...)` line; also when switching from plain account config to operator mode and deleting the resolver block.","solutions":["Add a resolver to the config, e.g. `resolver: MEMORY` with `include accounts/` directives, or `resolver: URL(nats://resolver-host:4222)` for a NATS-based resolver","If you only need static accounts, drop the operator setting and configure accounts/users directly instead of operator mode","Verify with `nats-server -c nats.conf -t` (config test) before deploying"],"exampleFix":"// before\noperator: eyJhbGciOi... \n// after\noperator: eyJhbGciOi...\nresolver: MEMORY\nresolver_preload: {\n  AD...: eyJhbGciOi...\n}","handlingStrategy":"validation","validationCode":"// Go: check options before ProcessOptions/ValidateOptions\nif len(o.TrustedOperators) > 0 && o.AccountResolver == nil {\n    return fmt.Errorf(\"config sets operators but no resolver\")\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always pair an `operator:` line with a `resolver:` line in configs","Run `nats-server -c file.conf -t` in CI to validate configs","Keep a template operator config that includes resolver_preload"],"tags":["nats","jwt","config-validation","operator-mode"],"backgroundTag":"missing-config-option","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}