{"record":{"id":"8ddd6174d49b95ee","repo":"nats-io/nats-server","slug":"credentials-have-been-revoked","errorCode":null,"errorMessage":"credentials have been revoked","messagePattern":"credentials have been revoked","errorType":"error_code","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/errors.go","lineNumber":172,"sourceCode":"\n\t// ErrClientOrRouteConnectedToGatewayPort represents an error condition when\n\t// a client or route attempted to connect to the Gateway port.\n\tErrClientOrRouteConnectedToGatewayPort = errors.New(\"attempted to connect to gateway port\")\n\n\t// ErrWrongGateway represents an error condition when a server receives a connect\n\t// request from a remote Gateway with a destination name that does not match the server's\n\t// Gateway's name.\n\tErrWrongGateway = errors.New(\"wrong gateway\")\n\n\t// ErrGatewayNameHasSpaces signals that the gateway name contains spaces, which is not allowed.\n\tErrGatewayNameHasSpaces = errors.New(\"gateway name cannot contain spaces\")\n\n\t// ErrNoSysAccount is returned when an attempt to publish or subscribe is made\n\t// when there is no internal system account defined.\n\tErrNoSysAccount = errors.New(\"system account not setup\")\n\n\t// ErrRevocation is returned when a credential has been revoked.\n\tErrRevocation = errors.New(\"credentials have been revoked\")\n\n\t// ErrServerNotRunning is used to signal an error that a server is not running.\n\tErrServerNotRunning = errors.New(\"server is not running\")\n\n\t// ErrServerNameHasSpaces signals that the server name contains spaces, which is not allowed.\n\tErrServerNameHasSpaces = errors.New(\"server name cannot contain spaces\")\n\n\t// ErrBadMsgHeader signals the parser detected a bad message header\n\tErrBadMsgHeader = errors.New(\"bad message header detected\")\n\n\t// ErrMsgHeadersNotSupported signals the parser detected a message header\n\t// but they are not supported on this server.\n\tErrMsgHeadersNotSupported = errors.New(\"message headers not supported\")\n\n\t// ErrNoRespondersRequiresHeaders signals that a client needs to have headers\n\t// on if they want no responders behavior.\n\tErrNoRespondersRequiresHeaders = errors.New(\"no responders requires headers support\")\n","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/errors.go#L154-L190","documentation":"ErrRevocation indicates that the credentials (account or user JWT) being used have been revoked and are therefore no longer acceptable for authentication. Declared at server/errors.go:172, it is a public sentinel returned/compared when the server detects a revoked credential during connection or account loading.","triggerScenarios":"A user or account JWT whose `revoked` status was pushed to the server (revocation list in operator/account claims) attempts to connect; a long-lived client reconnects after its credentials were rotated/revoked; credentials activated before a revocation timestamp.","commonSituations":"Ops revoked a leaked credential while the owning service keeps retrying; credential rotation pipelines issuing new creds but old clients not updated; clocks/time skew making recently issued creds appear pre-revocation.","solutions":["Issue new credentials with `nsc` and deploy them to the client.","Confirm the revocation list in the account/operator JWT includes only the intended subjects/timestamps and push the updated JWT.","Update the client's credentials file/config and restart it.","If revocation was accidental, issue fresh (non-revoked) credentials—revocation cannot be undone for already-revoked creds."],"exampleFix":"// before: client using creds/nsc.creds that were revoked\n// after\nnsc generate creds --account A --name deploy-bot --output creds/deploy-bot.creds\n# redeploy creds/deploy-bot.creds to the client and restart","handlingStrategy":"fallback","validationCode":"// Before connecting, check the creds file mtime/subject against your rotation ledger;\n// optionally decode the JWT and compare its issued-at against known revocation times.","typeGuard":null,"tryCatchPattern":"if err := connectWithCreds(path); err != nil {\n    if errors.Is(err, ErrRevocation) || strings.Contains(err.Error(), \"revoked\") {\n        // fetch fresh credentials from your secrets manager and retry once\n    }\n}","preventionTips":["Automate credential rotation so clients always run with the latest creds.","Watch system-account advisories for revocation events and trigger redeployment.","Never hardcode long-lived creds in images; mount them from a secret store.","Keep an audit trail of which creds are revoked per account."],"tags":["nats","authentication","credentials","revocation","security"],"backgroundTag":"credentials-revoked","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}