{"record":{"id":"cc722a00b7e5083d","repo":"nats-io/nats-server","slug":"account-jwt-not-found","errorCode":null,"errorMessage":"account jwt not found","messagePattern":"account jwt not found","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/accounts.go","lineNumber":4776,"sourceCode":"\t\t\tselect {\n\t\t\tcase respC <- clone:\n\t\t\tdefault:\n\t\t\t}\n\t\t}\n\t}\n\ts.sendInternalMsg(accountLookupRequest, replySubj, nil, []byte{})\n\tquit := s.quitCh\n\ts.mu.Unlock()\n\tvar err error\n\tvar theJWT string\n\tselect {\n\tcase <-quit:\n\t\terr = errors.New(\"fetching jwt failed due to shutdown\")\n\tcase <-time.After(timeout):\n\t\terr = errors.New(\"fetching jwt timed out\")\n\tcase m := <-respC:\n\t\tif len(m) == 0 {\n\t\t\terr = errors.New(\"account jwt not found\")\n\t\t} else if err = res.Store(name, string(m)); err == nil {\n\t\t\ttheJWT = string(m)\n\t\t}\n\t}\n\ts.mu.Lock()\n\tdelete(replies, replySubj)\n\ts.mu.Unlock()\n\tclose(respC)\n\treturn theJWT, err\n}\n\nfunc NewCacheDirAccResolver(path string, limit int64, ttl time.Duration, opts ...DirResOption) (*CacheDirAccResolver, error) {\n\tif limit <= 0 {\n\t\tlimit = 1_000\n\t}\n\tstore, err := NewExpiringDirJWTStore(path, false, true, HardDelete, 0, limit, true, ttl, nil)\n\tif err != nil {\n\t\treturn nil, err","sourceCodeStart":4758,"sourceCodeEnd":4794,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/accounts.go#L4758-L4794","documentation":"In the NATS server, account JWTs are fetched from an upstream resolver (e.g. an operator's account resolver) via an internal request/reply round trip. When the reply arrives but the response message is empty, the server sets err to errors.New(\"account jwt not found\") in server/accounts.go (~line 4776) instead of a JWT. This means the lookup completed but no JWT payload was returned for that account name.","triggerScenarios":"Calling an API that resolves an account JWT (via Fetch, the resolver's Store/Load path, or server startup fetching accounts) when the response channel receives a zero-length message. This happens with a resolver backend (mem/dir/nats) that has no JWT for the requested account, or when the upstream 'accs' subscription replies with an empty payload.","commonSituations":"Misconfigured resolver URL pointing at a resolver service that doesn't know the account; an operator account JWT not yet pushed/uploaded to the resolver; using a memory resolver without the account embedded in the operator JWT; a fresh cluster where account claims were never uploaded; typos in the account public key (NKEY) used for lookup.","solutions":["Verify the account JWT actually exists in the resolver backend: for a nats resolver, run 'nsc describe account' / check the resolver store; for a dir resolver, confirm the JWT file exists in the resolver directory for that account public key.","Re-push the account: run 'nsc push -a <account>' (or 'nsc push -A' for all accounts) so the resolver has the JWT.","Check the resolver configuration (resolver: URL / directory) in the server config — a wrong URL or directory silently yields empty responses.","Confirm the account public key used for the lookup matches the subject in the account JWT.","If running a memory resolver, ensure the account was embedded in the operator JWT and the operator JWT was updated on the server."],"exampleFix":"// before: config points at an empty resolver store\nresolver: URL(nats://resolver:4222)\n// after: push the account JWT so lookups succeed\n//   nsc push --url nats://resolver:4222 -a ACCTPUBLICKEY\nresolver: URL(nats://resolver:4222)","handlingStrategy":"retry","validationCode":"// before relying on resolver lookup, confirm the JWT is retrievable\nclaims, err := jwt.DecodeAccountClaims(pubKey) // or load from nsc store\nif err != nil {\n    return fmt.Errorf(\"account %s has no JWT in the store: %w\", pubKey, err)\n}\nif claims.Subject != pubKey {\n    return fmt.Errorf(\"account %s: subject mismatch, re-push JWT\", pubKey)\n}","typeGuard":null,"tryCatchPattern":"jwt, err := resolver.Fetch(pubKey)\nif err != nil {\n    if strings.Contains(err.Error(), \"account jwt not found\") {\n        // push the JWT then retry once\n        if perr := pushAccountJWT(pubKey); perr == nil {\n            jwt, err = resolver.Fetch(pubKey)\n        }\n    }\n    if err != nil { return err }\n}","preventionTips":["Run 'nsc push -A' after every account change so the resolver store is current.","Validate resolver URL/directory settings before starting the server.","Log and alert on resolver fetch failures at startup (server prints resolver errors).","Never hand-edit account public keys in configs; generate them with nsc."],"tags":["nats","jwt","resolver","configuration"],"backgroundTag":"jwt-not-found","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}