{"record":{"id":"d0ce23ccaf4152ed","repo":"nats-io/nats-server","slug":"preload-account-error-for-q-v","errorCode":null,"errorMessage":"preload account error for %q: %v","messagePattern":"preload account error for %q: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/server.go","lineNumber":1519,"sourceCode":"\t\t\t\tif t, ok := ar.c.Transport.(*http.Transport); ok {\n\t\t\t\t\tt.CloseIdleConnections()\n\t\t\t\t\tt.TLSClientConfig = opts.AccountResolverTLSConfig.Clone()\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\tif len(opts.resolverPreloads) > 0 {\n\t\t\t// Lock ordering is account resolver -> server, so we need to release\n\t\t\t// the lock and reacquire it when done with account resolver's calls.\n\t\t\tar := s.accResolver\n\t\t\ts.mu.Unlock()\n\t\t\tdefer s.mu.Lock()\n\t\t\tif ar.IsReadOnly() {\n\t\t\t\treturn fmt.Errorf(\"resolver preloads only available for writeable resolver types MEM/DIR/CACHE_DIR\")\n\t\t\t}\n\t\t\tfor k, v := range opts.resolverPreloads {\n\t\t\t\t_, err := jwt.DecodeAccountClaims(v)\n\t\t\t\tif err != nil {\n\t\t\t\t\treturn fmt.Errorf(\"preload account error for %q: %v\", k, err)\n\t\t\t\t}\n\t\t\t\tar.Store(k, v)\n\t\t\t}\n\t\t}\n\t}\n\treturn nil\n}\n\n// This will check preloads for validation issues.\nfunc (s *Server) checkResolvePreloads() {\n\topts := s.getOpts()\n\t// We can just check the read-only opts versions here, that way we do not need\n\t// to grab server lock or access s.accResolver.\n\tfor k, v := range opts.resolverPreloads {\n\t\tclaims, err := jwt.DecodeAccountClaims(v)\n\t\tif err != nil {\n\t\t\ts.Errorf(\"Preloaded account [%s] not valid\", k)\n\t\t\tcontinue","sourceCodeStart":1501,"sourceCodeEnd":1537,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/server.go#L1501-L1537","documentation":"One of the entries in `resolver_preload` failed JWT account-claims decoding. The value under key %q is not a valid account JWT (bad base64/JWS structure, truncated, or corrupt), so the server refuses to preload it and aborts option processing.","triggerScenarios":"Calling ProcessOptions/Start with opts.resolverPreloads containing a value for which jwt.DecodeAccountClaims errors: value is empty, whitespace-wrapped, truncated, or not an account claims JWT (e.g. an operator JWT pasted by mistake).","commonSituations":"Pasting a JWT that lost characters through shell/editor mangling; storing the wrong JWT type (user or operator claims instead of account); YAML quoting stripping characters; using `nsc describe` output instead of the raw JWT file contents.","solutions":["Regenerate/copy the account JWT: `nsc generate profile` or read the raw file under nsc's accounts dir and paste it fully","Validate out-of-band with `nsc accounts report` or `nats account info` before adding to config","Ensure correct JWT type: decode the first JSON payload segment and check `claims.nats.type == \"account\"`","Check YAML/JSON quoting so no characters are dropped or mangled"],"exampleFix":"// before\nresolver_preload = { MYACC: \"nsc describe -o me -a myacc output\" }\n// after\nresolver_preload = { MYACC: \"eyJ0eXAiOiJKV1QiLCJhbGciOiJlZDI1NTE5In0.eyJ...\" }","handlingStrategy":"validation","validationCode":"import \"github.com/nats-io/jwt/v2\"\n\nfunc validatePreloads(preloads map[string]string) error {\n    for k, v := range preloads {\n        c, err := jwt.DecodeAccountClaims(v)\n        if err != nil {\n            return fmt.Errorf(\"preload %q is not a valid account JWT: %v\", k, err)\n        }\n        _ = c\n    }\n    return nil\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy JWTs from the raw nsc store files, not from `nsc describe` pretty output","Validate each JWT with jwt.DecodeAccountClaims in CI before deploy","Check claims type is \"account\" (not operator/user)","Watch for YAML/JSON quoting that truncates long JWT strings"],"tags":["nats-server","jwt","account-claims","configuration"],"backgroundTag":"jwt-decode-failed","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}