{"record":{"id":"a411e4706fba6e38","repo":"nats-io/nats-server","slug":"trusted-keys-q-are-required-to-be-a-valid-public","errorCode":null,"errorMessage":"trusted Keys %q are required to be a valid public operator nkey","messagePattern":"trusted Keys %q are required to be a valid public operator nkey","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/jwt.go","lineNumber":159,"sourceCode":"\t\t\treturn fmt.Errorf(\"operator %s expected update version %d > server update version %d\",\n\t\t\t\topc.Subject, update, srvUpdate)\n\t\t}\n\t}\n\t// If we have operators, fill in the trusted keys.\n\t// FIXME(dlc) - We had TrustedKeys before TrustedOperators. The jwt.OperatorClaims\n\t// has a DidSign(). Use that longer term. For now we can expand in place.\n\tfor _, opc := range o.TrustedOperators {\n\t\tif o.TrustedKeys == nil {\n\t\t\to.TrustedKeys = make([]string, 0, 4)\n\t\t}\n\t\tif !opc.StrictSigningKeyUsage {\n\t\t\to.TrustedKeys = append(o.TrustedKeys, opc.Subject)\n\t\t}\n\t\to.TrustedKeys = append(o.TrustedKeys, opc.SigningKeys...)\n\t}\n\tfor _, key := range o.TrustedKeys {\n\t\tif !nkeys.IsValidPublicOperatorKey(key) {\n\t\t\treturn fmt.Errorf(\"trusted Keys %q are required to be a valid public operator nkey\", key)\n\t\t}\n\t}\n\tif len(o.resolverPinnedAccounts) > 0 {\n\t\tfor key := range o.resolverPinnedAccounts {\n\t\t\tif !nkeys.IsValidPublicAccountKey(key) {\n\t\t\t\treturn fmt.Errorf(\"pinned account key %q is not a valid public account nkey\", key)\n\t\t\t}\n\t\t}\n\t\t// ensure the system account (belonging to the operator can always connect)\n\t\tif o.SystemAccount != _EMPTY_ {\n\t\t\to.resolverPinnedAccounts[o.SystemAccount] = struct{}{}\n\t\t}\n\t}\n\n\t// If we have an auth callout defined make sure we are not in operator mode.\n\tif o.AuthCallout != nil {\n\t\treturn errors.New(\"operators do not allow authorization callouts to be configured directly\")\n\t}","sourceCodeStart":141,"sourceCodeEnd":177,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jwt.go#L141-L177","documentation":"Options validation after collecting trusted keys from operator claims: a key appended to o.TrustedKeys (operator subject or signing key, or explicit trusted_keys) failed nkeys.IsValidPublicOperatorKey, so it cannot participate in operator-signature verification.","triggerScenarios":"Thrown at server/jwt.go:159 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure trusted keys and operator signing keys are valid 'O'-type public nkeys","Regenerate the operator with proper nkeys","Remove mistyped entries from trusted_keys in the config"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}