{"record":{"id":"86ed9a487fb3d818","repo":"nats-io/nats-server","slug":"validation-errors-v","errorCode":null,"errorMessage":"validation errors: %v","messagePattern":"validation errors: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/accounts.go","lineNumber":4436,"sourceCode":"\t\tstrict = opts.TrustedOperators[0].StrictSigningKeyUsage\n\t\tif !strict {\n\t\t\tkeys[opts.TrustedOperators[0].Subject] = struct{}{}\n\t\t}\n\t\tfor _, key := range opts.TrustedOperators[0].SigningKeys {\n\t\t\tkeys[key] = struct{}{}\n\t\t}\n\t}\n\tif len(keys) == 0 {\n\t\treturn _EMPTY_, nil, false, fmt.Errorf(\"no operator key found\")\n\t}\n\treturn op, keys, strict, nil\n}\n\nfunc claimValidate(claim *jwt.AccountClaims) error {\n\tvr := &jwt.ValidationResults{}\n\tclaim.Validate(vr)\n\tif vr.IsBlocking(false) {\n\t\treturn fmt.Errorf(\"validation errors: %v\", vr.Errors())\n\t}\n\treturn nil\n}\n\nfunc removeCb(s *Server, pubKey string) {\n\tv, ok := s.accounts.Load(pubKey)\n\tif !ok {\n\t\treturn\n\t}\n\ta := v.(*Account)\n\ts.Debugf(\"Disable account %s due to remove\", pubKey)\n\ta.mu.Lock()\n\t// lock out new clients\n\ta.msubs = 0\n\ta.mpay = 0\n\ta.mconns = 0\n\ta.mleafs = 0\n\ta.updated = time.Now()","sourceCodeStart":4418,"sourceCodeEnd":4454,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/accounts.go#L4418-L4454","documentation":"claimValidate validates an *jwt.AccountClaims using the nkeys/jwt library's ValidationResults. If any blocking validation errors are found (expired/invalid dates, bad subject/public key pairing, malformed limits, etc.), the server wraps all of them in 'validation errors: %v' and rejects the account claim update.","triggerScenarios":"Publishing an account JWT whose claims fail jwt.AccountClaims.Validate with blocking results — expired token, subject not a valid account key, issuer mismatch, negative/invalid limits or imports/exports issues.","commonSituations":"Clock skew between the signing host and server; expired accounts after revocation/expiry windows; hand-edited JWTs; old nats-server versions not accepting newer claim fields; nsc/jwt library version mismatches.","solutions":["Read the %v list in the error — it enumerates the exact validation failures — and fix the claim accordingly.","Re-issue the account JWT with nsc (or current nats.go jwt package) and re-push it.","Ensure server clock/NTP is correct and both nsc and nats-server are up to date."],"exampleFix":"// before\nclaim.Expires = time.Now().Add(-time.Hour).Unix() // already expired\n// after\nclaim.Expires = time.Now().Add(24 * time.Hour).Unix()\nvr := &jwt.ValidationResults{}\nclaim.Validate(vr)\nif vr.IsBlocking(false) { /* fix before publishing */ }","handlingStrategy":"validation","validationCode":"vr := &jwt.ValidationResults{}\nclaim.Validate(vr)\nif vr.IsBlocking(false) {\n    return fmt.Errorf(\"claim invalid: %v\", vr.Errors())\n}","typeGuard":null,"tryCatchPattern":"if err := pushAccountJWT(tok); err != nil && strings.Contains(err.Error(), \"validation errors\") {\n    var vr jwt.ValidationResults\n    fmt.Println(err) // enumerated causes: fix each, then re-push\n}","preventionTips":["Validate claims locally with jwt.ValidationResults before publishing","Keep clocks NTP-synced on signing and serving hosts","Keep nsc and nats-server versions current"],"tags":["nats","jwt","validation"],"backgroundTag":"jwt-validation-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}