{"record":{"id":"ce00a4bcf4f28e20","repo":"nats-io/nats-server","slug":"user-jwt-is-not-a-valid-scoped-user","errorCode":null,"errorMessage":"user JWT is not a valid scoped user","messagePattern":"user JWT is not a valid scoped user","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth_callout.go","lineNumber":239,"sourceCode":"\t\t} else {\n\t\t\tplacement = issuerAccount\n\t\t}\n\n\t\ttargetAcc, err := s.LookupAccount(placement)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"no valid account %q for auth callout response on account %q: %v\", placement, account, err)\n\t\t}\n\t\tif isOperatorMode {\n\t\t\t// this will validate the signing key that emitted the user, and if it is a signing\n\t\t\t// key it assigns the permissions from the target account\n\t\t\tif scope, ok := targetAcc.hasIssuer(arc.Issuer); !ok {\n\t\t\t\treturn nil, fmt.Errorf(\"user JWT issuer %q is not known\", arc.Issuer)\n\t\t\t} else if scope != nil {\n\t\t\t\t// this possibly has to be different because it could just be a plain issued by a non-scoped signing key\n\t\t\t\tif err := scope.ValidateScopedSigner(arc); err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"user JWT is not valid: %v\", err)\n\t\t\t\t} else if uSc, ok := scope.(*jwt.UserScope); !ok {\n\t\t\t\t\treturn nil, fmt.Errorf(\"user JWT is not a valid scoped user\")\n\t\t\t\t} else if arc.User.UserPermissionLimits, err = processUserPermissionsTemplate(uSc.Template, arc, targetAcc); err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"user JWT generated invalid permissions: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn targetAcc, nil\n\t}\n\n\tprocessReply := func(_ *subscription, rc *client, racc *Account, subject, reply string, rmsg []byte) {\n\t\tarc, err := decodeResponse(rc, rmsg, racc)\n\t\tif err != nil {\n\t\t\tc.authViolation()\n\t\t\trespCh <- titleCase(err.Error())\n\t\t\treturn\n\t\t}\n\t\t// If the caller had established that the user should go through a proxy,\n\t\t// or if the `arc` JWT requires it, and we don't have a trusted proxy,\n\t\t// reject the connection.","sourceCodeStart":221,"sourceCodeEnd":257,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth_callout.go#L221-L257","documentation":"Auth callout response processing in operator mode: the returned user JWT was issued by a signing key with a scope, and scope validation determined the JWT is not a valid scoped-to-user JWT (wrong claims/signature for scoped access).","triggerScenarios":"Thrown at server/auth_callout.go:239 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the auth callout service signs responses with a proper scoped signing key","Check the user JWT includes the required scope fields","Re-issue the user JWT from the account's signing keys"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}