{"record":{"id":"8fc5b969a38deabb","repo":"nats-io/nats-server","slug":"operator-mode-and-non-account-nkeys-are-incompatib","errorCode":null,"errorMessage":"operator mode and non account nkeys are incompatible","messagePattern":"operator mode and non account nkeys are incompatible","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/leafnode.go","lineNumber":282,"sourceCode":"\t\tfor _, r := range o.LeafNode.Remotes {\n\t\t\tif err := checkAccountExists(r.LocalAccount, \"remote\"); err != nil {\n\t\t\t\treturn err\n\t\t\t}\n\t\t}\n\t} else {\n\t\tif len(o.LeafNode.Users) != 0 {\n\t\t\treturn fmt.Errorf(\"operator mode does not allow specifying users in leafnode config\")\n\t\t}\n\t\tfor _, r := range o.LeafNode.Remotes {\n\t\t\tif !nkeys.IsValidPublicAccountKey(r.LocalAccount) {\n\t\t\t\treturn fmt.Errorf(\n\t\t\t\t\t\"operator mode requires account nkeys in remotes. \" +\n\t\t\t\t\t\t\"Please add an `account` key to each remote in your `leafnodes` section, to assign it to an account. \" +\n\t\t\t\t\t\t\"Each account value should be a 56 character public key, starting with the letter 'A'\")\n\t\t\t}\n\t\t}\n\t\tif o.LeafNode.Port != 0 && o.LeafNode.Account != \"\" && !nkeys.IsValidPublicAccountKey(o.LeafNode.Account) {\n\t\t\treturn fmt.Errorf(\"operator mode and non account nkeys are incompatible\")\n\t\t}\n\t}\n\n\t// Validate compression settings\n\tif o.LeafNode.Compression.Mode != _EMPTY_ {\n\t\tif err := validateAndNormalizeCompressionOption(&o.LeafNode.Compression, CompressionS2Auto); err != nil {\n\t\t\treturn err\n\t\t}\n\t}\n\n\t// If a remote has a websocket scheme, all need to have it.\n\tfor _, rcfg := range o.LeafNode.Remotes {\n\t\t// Validate proxy configuration\n\t\tif _, err := validateLeafNodeProxyOptions(rcfg); err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tif len(rcfg.URLs) >= 2 {","sourceCodeStart":264,"sourceCodeEnd":300,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/leafnode.go#L264-L300","documentation":"Leafnode operator-mode validation: a leafnode user entry specifies a password/username (non-nkey credentials), which cannot coexist with operator mode where authentication must be nkey/JWT based.","triggerScenarios":"Thrown at server/leafnode.go:282 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Replace username/password leafnode users with nkey users","Remove password credentials from leafnode users in operator mode","Use operator-signed JWTs for leafnode authentication"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}