nats-io/nats-server · error

invalid connection types %q

Error message

invalid connection types %q

What it means

Returned by the accounts/connection-types validation (server/client.go:6853): the map of connection types contains entries the server does not recognize. The function still returns the map of valid types but flags the unknown ones in the error, listing them with %q.

Source

Thrown at server/client.go:6853

func convertAllowedConnectionTypes(cts []string) (map[string]struct{}, error) {
	var unknown []string
	m := make(map[string]struct{}, len(cts))
	for _, i := range cts {
		i = strings.ToUpper(i)
		switch i {
		case jwt.ConnectionTypeStandard, jwt.ConnectionTypeWebsocket,
			jwt.ConnectionTypeLeafnode, jwt.ConnectionTypeLeafnodeWS,
			jwt.ConnectionTypeMqtt, jwt.ConnectionTypeMqttWS,
			jwt.ConnectionTypeInProcess:
			m[i] = struct{}{}
		default:
			unknown = append(unknown, i)
		}
	}
	var err error
	// We will still return the map of valid ones.
	if len(unknown) != 0 {
		err = fmt.Errorf("invalid connection types %q", unknown)
	}
	return m, err
}

// This will return true if the connection is of a type present in the given `acts` map.
// Note that so far this is used only for CLIENT or LEAF connections.
// But a CLIENT can be standard or websocket (and other types in the future).
func (c *client) connectionTypeAllowed(acts map[string]struct{}) bool {
	// Empty means all type of clients are allowed
	if len(acts) == 0 {
		return true
	}
	var want string
	switch c.kind {
	case CLIENT:
		switch c.clientType() {
		case NATS:
			if c.iproc {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Remove or correct the unknown connection type in the account JWT / config, keeping only recognized values (CLIENT, LEAF)
2. Validate the account JWT with `nsc` or the server's account resolver to see which entry is rejected
3. Check the server version's supported connection types; upgrade the server if the type is legitimately newer

Example fix

// before (config)
connection_types: ["CLIENT", "SERVICE"]
// after
connection_types: ["CLIENT", "LEAF"]

allowed := map[string]bool{"CLIENT": true, "LEAF": true}
for _, t := range cfg.ConnectionTypes {
    if !allowed[strings.ToUpper(t)] {
        return fmt.Errorf("unknown connection type %q", t)
    }
}

func isKnownConnType(t string) bool {
    switch strings.ToUpper(t) {
    case "CLIENT", "LEAF":
        return true
    }
    return false
}

When it happens

Trigger: An account config (or JWT) declares a connection_types/connections entry whose value is not a known type (only CLIENT and LEAF are recognized, per the following helper used only for CLIENT/LEAF), e.g. `connection_types: ["CLIENT", "SERVICE"]`.

Common situations: Typos in account JWT or nats-server config connection_types lists, copying config from newer/older server versions that support different type names, operator JWT tooling emitting unsupported values.

Related errors

• publish deny: %w
• subscribe allow: %w
• subscribe deny: %w
• max_ack_pending must be set to -1
• bad sampling percentage, should be 1-100

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/7f9729a6a850b7e4. Report an issue: GitHub.