{"record":{"id":"b890412cee7fa35c","repo":"nats-io/nats-server","slug":"system-account-in-config-and-operator-jwt-must-be","errorCode":null,"errorMessage":"system_account in config and operator JWT must be identical","messagePattern":"system_account in config and operator JWT must be identical","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/jwt.go","lineNumber":116,"sourceCode":"\t\treturn fmt.Errorf(\"operators do not allow users to be configured directly\")\n\t}\n\tif len(o.TrustedOperators) > 0 && len(o.TrustedKeys) > 0 {\n\t\treturn fmt.Errorf(\"conflicting options for 'TrustedKeys' and 'TrustedOperators'\")\n\t}\n\tif o.SystemAccount != _EMPTY_ {\n\t\tfoundSys := false\n\t\tfoundNonEmpty := false\n\t\tfor _, op := range o.TrustedOperators {\n\t\t\tif op.SystemAccount != _EMPTY_ {\n\t\t\t\tfoundNonEmpty = true\n\t\t\t}\n\t\t\tif op.SystemAccount == o.SystemAccount {\n\t\t\t\tfoundSys = true\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tif foundNonEmpty && !foundSys {\n\t\t\treturn fmt.Errorf(\"system_account in config and operator JWT must be identical\")\n\t\t}\n\t} else if o.TrustedOperators[0].SystemAccount == _EMPTY_ {\n\t\t// In case the system account is neither defined in config nor in the first operator.\n\t\t// If it would be needed due to the nats account resolver, raise an error.\n\t\tswitch o.AccountResolver.(type) {\n\t\tcase *DirAccResolver, *CacheDirAccResolver:\n\t\t\treturn fmt.Errorf(\"using nats based account resolver - the system account needs to be specified in configuration or the operator jwt\")\n\t\t}\n\t}\n\n\tsrvMajor, srvMinor, srvUpdate, _ := versionComponents(VERSION)\n\tfor _, opc := range o.TrustedOperators {\n\t\tif major, minor, update, err := jwt.ParseServerVersion(opc.AssertServerVersion); err != nil {\n\t\t\treturn fmt.Errorf(\"operator %s expects version %s got error instead: %s\",\n\t\t\t\topc.Subject, opc.AssertServerVersion, err)\n\t\t} else if major > srvMajor {\n\t\t\treturn fmt.Errorf(\"operator %s expected major version %d > server major version %d\",\n\t\t\t\topc.Subject, major, srvMajor)","sourceCodeStart":98,"sourceCodeEnd":134,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jwt.go#L98-L134","documentation":"When a system_account is set in the config, at least one operator JWT must declare the same system account. This error is thrown when operators define system accounts but none matches the config value, indicating an inconsistent trust setup.","triggerScenarios":"Config has `system_account: AD...` and one or more operator JWTs whose SystemAccount is non-empty but different (or none equal to the config value); validateOptions fails.","commonSituations":"Re-keying or recreating the system account with nsc and forgetting to update either the config or re-issue operator JWTs; copying an operator JWT from another deployment.","solutions":["Make the config `system_account` identical to the one in the operator JWT(s)","Regenerate operator JWTs with the correct system account: `nsc edit operator --system-account AD...` then redeploy the updated JWT"],"exampleFix":"// before\nsystem_account: ADOLD...\n// after (match the operator JWT's system account)\nsystem_account: ADNEW...","handlingStrategy":"validation","validationCode":"// Go: ensure operator system accounts match config\nfor _, op := range o.TrustedOperators {\n    if op.SystemAccount != \"\" && o.SystemAccount != \"\" && op.SystemAccount != o.SystemAccount {\n        return fmt.Errorf(\"system account mismatch with operator\")\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Generate both operator JWT and config system_account from the same nsc operator","Re-run `nsc describe operator` after any system account change and sync the config","Diff system_account values between config and JWT in deployment scripts"],"tags":["nats","jwt","system-account","config-validation"],"backgroundTag":"configuration-mismatch","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}