What causes "credentials have been revoked" in nats-io/nats-server?

Issue new credentials with `nsc` and deploy them to the client.

credentials have been revoked

Error message

credentials have been revoked

What it means

ErrRevocation indicates that the credentials (account or user JWT) being used have been revoked and are therefore no longer acceptable for authentication. Declared at server/errors.go:172, it is a public sentinel returned/compared when the server detects a revoked credential during connection or account loading.

Source

Thrown at server/errors.go:172

	// ErrClientOrRouteConnectedToGatewayPort represents an error condition when
	// a client or route attempted to connect to the Gateway port.
	ErrClientOrRouteConnectedToGatewayPort = errors.New("attempted to connect to gateway port")

	// ErrWrongGateway represents an error condition when a server receives a connect
	// request from a remote Gateway with a destination name that does not match the server's
	// Gateway's name.
	ErrWrongGateway = errors.New("wrong gateway")

	// ErrGatewayNameHasSpaces signals that the gateway name contains spaces, which is not allowed.
	ErrGatewayNameHasSpaces = errors.New("gateway name cannot contain spaces")

	// ErrNoSysAccount is returned when an attempt to publish or subscribe is made
	// when there is no internal system account defined.
	ErrNoSysAccount = errors.New("system account not setup")

	// ErrRevocation is returned when a credential has been revoked.
	ErrRevocation = errors.New("credentials have been revoked")

	// ErrServerNotRunning is used to signal an error that a server is not running.
	ErrServerNotRunning = errors.New("server is not running")

	// ErrServerNameHasSpaces signals that the server name contains spaces, which is not allowed.
	ErrServerNameHasSpaces = errors.New("server name cannot contain spaces")

	// ErrBadMsgHeader signals the parser detected a bad message header
	ErrBadMsgHeader = errors.New("bad message header detected")

	// ErrMsgHeadersNotSupported signals the parser detected a message header
	// but they are not supported on this server.
	ErrMsgHeadersNotSupported = errors.New("message headers not supported")

	// ErrNoRespondersRequiresHeaders signals that a client needs to have headers
	// on if they want no responders behavior.
	ErrNoRespondersRequiresHeaders = errors.New("no responders requires headers support")

View on GitHub (pinned to 3a66a489d2)

Solutions

Issue new credentials with `nsc` and deploy them to the client.
Confirm the revocation list in the account/operator JWT includes only the intended subjects/timestamps and push the updated JWT.
Update the client's credentials file/config and restart it.
If revocation was accidental, issue fresh (non-revoked) credentials—revocation cannot be undone for already-revoked creds.

Example fix

// before: client using creds/nsc.creds that were revoked
// after
nsc generate creds --account A --name deploy-bot --output creds/deploy-bot.creds
# redeploy creds/deploy-bot.creds to the client and restart

Defensive patterns

Strategy: fallback

Validate before calling

// Before connecting, check the creds file mtime/subject against your rotation ledger;
// optionally decode the JWT and compare its issued-at against known revocation times.

Try / catch

if err := connectWithCreds(path); err != nil {
    if errors.Is(err, ErrRevocation) || strings.Contains(err.Error(), "revoked") {
        // fetch fresh credentials from your secrets manager and retry once
    }
}

Prevention

Automate credential rotation so clients always run with the latest creds.
Watch system-account advisories for revocation events and trigger redeployment.
Never hardcode long-lived creds in images; mount them from a secret store.
Keep an audit trail of which creds are revoked per account.

When it happens

Trigger: A user or account JWT whose `revoked` status was pushed to the server (revocation list in operator/account claims) attempts to connect; a long-lived client reconnects after its credentials were rotated/revoked; credentials activated before a revocation timestamp.

Common situations: Ops revoked a leaked credential while the owning service keeps retrying; credential rotation pipelines issuing new creds but old clients not updated; clocks/time skew making recently issued creds appear pre-revocation.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/8ddd6174d49b95ee. Report an issue: GitHub.