default_js_domain contains account name %q, which is not a v

Error message

default_js_domain contains account name %q, which is not a valid public account nkey

What it means

In operator mode (when an explicit system account name is not the default), accounts referenced in default_js_domain must be public account nkeys (N keys starting with 'A'). The server validates each key with nkeys.IsValidPublicAccountKey and rejects startup if an entry is not a valid public account key, since operator mode identifies accounts by nkey, not name.

Source

Thrown at server/jetstream.go:2907

				} else {
					for _, acc := range o.Accounts {
						if a == acc.GetName() {
							if len(acc.jsLimits) > 0 && domain != _EMPTY_ {
								return fmt.Errorf("default_js_domain contains account name %q with enabled JetStream", a)
							}
							found = true
							break
						}
					}
				}
				if !found {
					return fmt.Errorf("in non operator mode, `default_js_domain` references non existing account %q", a)
				}
			}
		} else {
			for a := range o.JsAccDefaultDomain {
				if !nkeys.IsValidPublicAccountKey(a) {
					return fmt.Errorf("default_js_domain contains account name %q, which is not a valid public account nkey", a)
				}
			}
		}
		for a, d := range o.JsAccDefaultDomain {
			sacc := DEFAULT_SYSTEM_ACCOUNT
			if o.SystemAccount != _EMPTY_ {
				sacc = o.SystemAccount
			}
			if a == sacc {
				return fmt.Errorf("system account %q can not be in default_js_domain", a)
			}
			if d == _EMPTY_ {
				continue
			}
			if sub := fmt.Sprintf(jsDomainAPI, d); !IsValidSubject(sub) {
				return fmt.Errorf("default_js_domain contains account %q with invalid domain name %q", a, d)
			}
		}

View on GitHub (pinned to 3a66a489d2)

Solutions

Replace each entry key with the account's public nkey (from the account JWT or `nsc list accounts`).
Validate keys with `nkeys` tooling or `nats account info` before adding.
Ensure keys are complete (56-char, 'A'-prefixed base32) and not user/server nkeys.
Run `nats-server -t` to validate config before restart.

Example fix

// before
operator mode:
default_js_domain: { payments: "domainA" }
// after
default_js_domain: { AD7R4WtgNVy...public_nkey...: "domainA" }

Defensive patterns

Strategy: validation

Validate before calling

for name := range cfg.DefaultJSDomain {
    if !strings.HasPrefix(name, "A") || len(name) != 56 {
        return fmt.Errorf("default_js_domain key %q is not a public account nkey", name)
    }
}

Prevention

Use `nsc list accounts` or account JWT issuer to copy exact nkeys
Never use account names, user nkeys (U...) or server nkeys (N...) in operator-mode mappings
Check key length/prefix (A..., 56 chars) before committing config
Run `nats-server -t` in CI for operator configs

When it happens

Trigger: Operator-mode config where JsAccDefaultDomain keys are human-readable account names, bare IDs, or malformed nkeys instead of valid public account nkeys (e.g. 'AD...' style, 56 chars, base32).

Common situations: Using account names in default_js_domain in a leaf/operator deployment; copy-pasting a user nkey ('U...') or signing key instead of an account nkey; truncating the nkey in YAML.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/11d16dd29e4fa58c. Report an issue: GitHub.