{"record":{"id":"ec575457fac20465","repo":"nats-io/nats-server","slug":"no-valid-account-q-for-auth-callout-response-on-a","errorCode":null,"errorMessage":"no valid account %q for auth callout response on account %q: %v","messagePattern":"no valid account %q for auth callout response on account %q: (.+?)","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"server/auth_callout.go","lineNumber":227,"sourceCode":"\t\t// Apply to this client.\n\t\tvar err error\n\t\tissuerAccount, err := getIssuerAccount(arc, account)\n\t\tif err != nil {\n\t\t\treturn nil, err\n\t\t}\n\n\t\t// if we are not in operator mode, they can specify placement as a tag\n\t\tvar placement string\n\t\tif !isOperatorMode {\n\t\t\t// only allow placement if we are not in operator mode\n\t\t\tplacement = arc.Audience\n\t\t} else {\n\t\t\tplacement = issuerAccount\n\t\t}\n\n\t\ttargetAcc, err := s.LookupAccount(placement)\n\t\tif err != nil {\n\t\t\treturn nil, fmt.Errorf(\"no valid account %q for auth callout response on account %q: %v\", placement, account, err)\n\t\t}\n\t\tif isOperatorMode {\n\t\t\t// this will validate the signing key that emitted the user, and if it is a signing\n\t\t\t// key it assigns the permissions from the target account\n\t\t\tif scope, ok := targetAcc.hasIssuer(arc.Issuer); !ok {\n\t\t\t\treturn nil, fmt.Errorf(\"user JWT issuer %q is not known\", arc.Issuer)\n\t\t\t} else if scope != nil {\n\t\t\t\t// this possibly has to be different because it could just be a plain issued by a non-scoped signing key\n\t\t\t\tif err := scope.ValidateScopedSigner(arc); err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"user JWT is not valid: %v\", err)\n\t\t\t\t} else if uSc, ok := scope.(*jwt.UserScope); !ok {\n\t\t\t\t\treturn nil, fmt.Errorf(\"user JWT is not a valid scoped user\")\n\t\t\t\t} else if arc.User.UserPermissionLimits, err = processUserPermissionsTemplate(uSc.Template, arc, targetAcc); err != nil {\n\t\t\t\t\treturn nil, fmt.Errorf(\"user JWT generated invalid permissions: %v\", err)\n\t\t\t\t}\n\t\t\t}\n\t\t}\n\t\treturn targetAcc, nil","sourceCodeStart":209,"sourceCodeEnd":245,"githubUrl":"https://github.com/nats-io/nats-server/blob/3a66a489d262bf89b71a71c955c94920394532f3/server/auth_callout.go#L209-L245","documentation":"The server resolved which account the callout response's user belongs to (placement: cr.IssuerAccount in operator mode, otherwise the issuer) and called s.LookupAccount; that account does not exist locally, so the response cannot be applied. The wrapped %v carries the underlying lookup error (e.g. account not found).","triggerScenarios":"The callout's AuthorizationResponseClaims references an account (via cr.IssuerAccount or issuer) that the server has not seen/loaded — LookupAccount returns an error — while processing an authorization response for the connecting user's account.","commonSituations":"Operator-mode deployments where the issuer account JWT was never pushed to the resolver; typo in the account public key configured in the callout; account deleted after the callout was configured.","solutions":["Ensure the referenced account exists: push its account JWT to the resolver/operator account server.","Fix the account public key configured in the callout service (check the quoted placement name in the error).","Verify the callout's cr.IssuerAccount points to a real account on this server, not a key from another deployment.","Trigger account lookup/refresh on the server (reconnect or nats account update) after pushing the JWT."],"exampleFix":"// before\ncr.IssuerAccount = \"ABC...typo'd-key\"\n// after\ncr.IssuerAccount = existingAccountPub // key present in the operator account list / resolver","handlingStrategy":"validation","validationCode":"// callout side: ensure referenced account is known\nif _, err := lookupAccount(cr.IssuerAccount); err != nil {\n    return fmt.Errorf(\"response references unknown account %q\", cr.IssuerAccount)\n}","typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"no valid account\") {\n    // push/refresh the account JWT, then retry authorization\n}","preventionTips":["Verify every account key configured in the callout exists on the server.","Push account JWTs to the resolver before enabling the callout for them.","Watch for account deletions that orphan callout configurations."],"tags":["auth-callout","account-lookup","jwt"],"backgroundTag":"account-not-found","analyzedSha":"3a66a489d262bf89b71a71c955c94920394532f3","analyzedAt":"2026-09-02T04:41:54.247Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}