nats-io/nats-server · error

bad account

Error message

bad account

What it means

ErrBadAccount is returned by client.registerWithAccount when the supplied Account is nil, or when the account is marked bad (e.g. it is being deleted or failed validation checks under acc.mu). The client cannot register with such an account and subscription setup fails.

Source

Thrown at server/errors.go:105

	ErrClientConnectedToLeafNodePort = errors.New("attempted to connect to leaf node port")

	// ErrLeafNodeHasSameClusterName represents an error condition when a leafnode is a cluster
	// and it has the same cluster name as the hub cluster.
	ErrLeafNodeHasSameClusterName = errors.New("remote leafnode has same cluster name")

	// ErrLeafNodeDisabled is when we disable leafnodes.
	ErrLeafNodeDisabled = errors.New("leafnodes disabled")

	// ErrConnectedToWrongPort represents an error condition when a connection is attempted
	// to the wrong listen port (for instance a LeafNode to a client port, etc...)
	ErrConnectedToWrongPort = errors.New("attempted to connect to wrong port")

	// ErrAccountExists is returned when an account is attempted to be registered
	// but already exists.
	ErrAccountExists = errors.New("account exists")

	// ErrBadAccount represents a malformed or incorrect account.
	ErrBadAccount = errors.New("bad account")

	// ErrReservedAccount represents a reserved account that can not be created.
	ErrReservedAccount = errors.New("reserved account")

	// ErrMissingAccount is returned when an account does not exist.
	ErrMissingAccount = errors.New("account missing")

	// ErrMissingService is returned when an account does not have an exported service.
	ErrMissingService = errors.New("service missing")

	// ErrBadServiceType is returned when latency tracking is being applied to non-singleton response types.
	ErrBadServiceType = errors.New("bad service response type")

	// ErrBadSampling is returned when the sampling for latency tracking is not 1 >= sample <= 100.
	ErrBadSampling = errors.New("bad sampling percentage, should be 1-100")

	// ErrAccountValidation is returned when an account has failed validation.
	ErrAccountValidation = errors.New("account validation failed")

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Ensure the account is fetched from the server (s.LookupAccount) and is non-nil before registering clients
2. Verify the account still exists and is not slated for deletion before use
3. Re-authenticate the client against a valid account; check resolver/JWT config so accounts resolve correctly

Example fix

// before
acc, _ := s.LookupAccount(name)
c.registerWithAccount(acc) // acc may be nil
// after
acc, err := s.LookupAccount(name)
if err != nil || acc == nil { return fmt.Errorf("account %q not available", name) }
return c.registerWithAccount(acc)

acc, err := s.LookupAccount(name)
if err != nil || acc == nil { return fmt.Errorf("account %q unavailable", name) }

func accountUsable(a *server.Account) bool { return a != nil }

if err := c.RegisterWithAccount(acc); err != nil {
    if errors.Is(err, server.ErrBadAccount) { /* refetch account, re-auth client */ }
    return err
}

When it happens

Trigger: Calling client registerWithAccount (directly or via subscription setup) with a nil *Account; attaching a client to an account that was concurrently removed from the server or flagged invalid; internal paths where an account lookup returned an account that failed integrity checks.

Common situations: Embedded-NATS code passing a nil account into internal APIs; client connecting right as the account is deleted via resolver updates; race between account removal and client (re)authentication.

Related errors

• account missing
• account exists
• reserved account
• account jwt not found
• auth callout violation: auth callout response is not for exp

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/b3f29c44028c01ce. Report an issue: GitHub.