{"record":{"id":"d4b79a74a74c5c0e","repo":"nats-io/nats-server","slug":"using-nats-based-account-resolver-the-system-acc","errorCode":null,"errorMessage":"using nats based account resolver - the system account needs to be specified in configuration or the operator jwt","messagePattern":"using nats based account resolver - the system account needs to be specified in configuration or the operator jwt","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/jwt.go","lineNumber":123,"sourceCode":"\t\tfoundNonEmpty := false\n\t\tfor _, op := range o.TrustedOperators {\n\t\t\tif op.SystemAccount != _EMPTY_ {\n\t\t\t\tfoundNonEmpty = true\n\t\t\t}\n\t\t\tif op.SystemAccount == o.SystemAccount {\n\t\t\t\tfoundSys = true\n\t\t\t\tbreak\n\t\t\t}\n\t\t}\n\t\tif foundNonEmpty && !foundSys {\n\t\t\treturn fmt.Errorf(\"system_account in config and operator JWT must be identical\")\n\t\t}\n\t} else if o.TrustedOperators[0].SystemAccount == _EMPTY_ {\n\t\t// In case the system account is neither defined in config nor in the first operator.\n\t\t// If it would be needed due to the nats account resolver, raise an error.\n\t\tswitch o.AccountResolver.(type) {\n\t\tcase *DirAccResolver, *CacheDirAccResolver:\n\t\t\treturn fmt.Errorf(\"using nats based account resolver - the system account needs to be specified in configuration or the operator jwt\")\n\t\t}\n\t}\n\n\tsrvMajor, srvMinor, srvUpdate, _ := versionComponents(VERSION)\n\tfor _, opc := range o.TrustedOperators {\n\t\tif major, minor, update, err := jwt.ParseServerVersion(opc.AssertServerVersion); err != nil {\n\t\t\treturn fmt.Errorf(\"operator %s expects version %s got error instead: %s\",\n\t\t\t\topc.Subject, opc.AssertServerVersion, err)\n\t\t} else if major > srvMajor {\n\t\t\treturn fmt.Errorf(\"operator %s expected major version %d > server major version %d\",\n\t\t\t\topc.Subject, major, srvMajor)\n\t\t} else if srvMajor > major {\n\t\t} else if minor > srvMinor {\n\t\t\treturn fmt.Errorf(\"operator %s expected minor version %d > server minor version %d\",\n\t\t\t\topc.Subject, minor, srvMinor)\n\t\t} else if srvMinor > minor {\n\t\t} else if update > srvUpdate {\n\t\t\treturn fmt.Errorf(\"operator %s expected update version %d > server update version %d\",","sourceCodeStart":105,"sourceCodeEnd":141,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/jwt.go#L105-L141","documentation":"A NATS-based account resolver (DirAccResolver/CacheDirAccResolver, i.e. resolver: URL(...)) needs a system account to run its internal resolver traffic. This error is thrown when neither the config nor the first operator JWT specifies a system account while such a resolver is configured.","triggerScenarios":"`resolver: URL(nats://...)` set, no `system_account` in config, and the first operator JWT has empty SystemAccount; validateOptions aborts startup.","commonSituations":"Standalone resolver-server setups where the operator was created without --system-account; minimal push/pull resolver configs missing the system_account line.","solutions":["Add `system_account: AD...` to the config matching the operator's system account","Or set one at operator level: `nsc edit operator --system-account AD...` and redeploy the operator JWT"],"exampleFix":"// before\noperator: eyJ...\nresolver: URL(nats://localhost:4222)\n// after\noperator: eyJ...\nresolver: URL(nats://localhost:4222)\nsystem_account: AD...","handlingStrategy":"validation","validationCode":"// Go: NATS-based resolvers require a system account\nswitch o.AccountResolver.(type) {\ncase *DirAccResolver, *CacheDirAccResolver:\n    if o.SystemAccount == \"\" && o.TrustedOperators[0].SystemAccount == \"\" {\n        return fmt.Errorf(\"set system_account for URL resolver\")\n    }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always create the operator with a system account (`nsc add operator --system-account`)","Keep system_account in both resolver server and managed-server configs","Check operator JWT contains a non-empty system_account before deploying URL resolvers"],"tags":["nats","jwt","system-account","account-resolver"],"backgroundTag":"missing-config-option","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T10:18:20.063Z"}