nats-io/nats-server · error

account resolver missing

Error message

account resolver missing

What it means

ErrNoAccountResolver is returned when an account update/fetch is attempted but the server has no account resolver configured. fetch() returns it when the server or the resolver is nil, and fetchUpdatedAccount returns it when s.AccountResolver() is nil — meaning there is no mechanism (URL resolver or MemAccResolver) to retrieve account claims.

Source

Thrown at server/errors.go:129

	ErrMissingAccount = errors.New("account missing")

	// ErrMissingService is returned when an account does not have an exported service.
	ErrMissingService = errors.New("service missing")

	// ErrBadServiceType is returned when latency tracking is being applied to non-singleton response types.
	ErrBadServiceType = errors.New("bad service response type")

	// ErrBadSampling is returned when the sampling for latency tracking is not 1 >= sample <= 100.
	ErrBadSampling = errors.New("bad sampling percentage, should be 1-100")

	// ErrAccountValidation is returned when an account has failed validation.
	ErrAccountValidation = errors.New("account validation failed")

	// ErrAccountExpired is returned when an account has expired.
	ErrAccountExpired = errors.New("account expired")

	// ErrNoAccountResolver is returned when we attempt an update but do not have an account resolver.
	ErrNoAccountResolver = errors.New("account resolver missing")

	// ErrAccountResolverUpdateTooSoon is returned when we attempt an update too soon to last request.
	ErrAccountResolverUpdateTooSoon = errors.New("account resolver update too soon")

	// ErrAccountResolverSameClaims is returned when same claims have been fetched.
	ErrAccountResolverSameClaims = errors.New("account resolver no new claims")

	// ErrStreamImportAuthorization is returned when a stream import is not authorized.
	ErrStreamImportAuthorization = errors.New("stream import not authorized")

	// ErrStreamImportBadPrefix is returned when a stream import prefix contains wildcards.
	ErrStreamImportBadPrefix = errors.New("stream import prefix can not contain wildcard tokens")

	// ErrStreamImportDuplicate is returned when a stream import is a duplicate of one that already exists.
	ErrStreamImportDuplicate = errors.New("stream import already exists")

	// ErrServiceImportAuthorization is returned when a service import is not authorized.
	ErrServiceImportAuthorization = errors.New("service import not authorized")

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Configure an account resolver in the server config (resolver: URL(...) or a memory resolver) before performing dynamic account updates
2. In code/tests, install a resolver via s.SetAccountResolver(...) before calling fetch/update paths
3. Skip fetch/update logic when the server is intentionally static (guard with s.AccountResolver() != nil)
4. Verify the server was started with the operator/resolver-based configuration you intended

Example fix

// before
jwt, err := s.fetchUpdatedAccount(acc) // no resolver -> ErrNoAccountResolver
// after
if s.AccountResolver() == nil {
	s.SetAccountResolver(newURLAccResolver(resolverURL))
}
jwt, err := s.fetchUpdatedAccount(acc)

if s.AccountResolver() == nil { return errors.New("account resolver not configured; cannot fetch dynamic account updates") }

func hasAccountResolver(s *Server) bool { return s != nil && s.AccountResolver() != nil }

jwt, err := s.fetchUpdatedAccount(acc)
if errors.Is(err, ErrNoAccountResolver) { /* fall back to statically configured account or configure a resolver */ }

When it happens

Trigger: Calling s.fetch / fetchUpdatedAccount on a server whose AccountResolver() returns nil — e.g. a server started with static account definitions and no resolver configured (no account resolver URL like nats:// or file resolver in the config).

Common situations: Deploying a server configured with inline accounts (no resolver) while code paths expect dynamic account claim updates; tests running against servers built without SetAccountResolver; mixing standalone and operator/resolver-based setups; calling Fetch/update APIs on a client-config-only server.

Related errors

• service missing
• account resolver update too soon
• stream import already exists
• account jwt not found
• subject has exceeded number of tokens limit

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/d6b7995733ca3577. Report an issue: GitHub.