nats-io/nats-server · error

invalid permissions for nkey %q: %w

Error message

invalid permissions for nkey %q: %w

What it means

Same options validation as for users, but for nkey entries in o.Nkeys: validatePermissionSubjects failed on the nkey's Permissions block and the error is wrapped with the nkey public key.

Source

Thrown at server/auth.go:1723

func validateAuth(o *Options) error {
	if err := validatePinnedCerts(o.TLSPinnedCerts); err != nil {
		return err
	}
	for _, u := range o.Users {
		if err := validateAllowedConnectionTypes(u.AllowedConnectionTypes); err != nil {
			return err
		}
		if err := validatePermissionSubjects(u.Permissions); err != nil {
			return fmt.Errorf("invalid permissions for user %q: %w", u.Username, err)
		}
	}
	for _, u := range o.Nkeys {
		if err := validateAllowedConnectionTypes(u.AllowedConnectionTypes); err != nil {
			return err
		}
		if err := validatePermissionSubjects(u.Permissions); err != nil {
			return fmt.Errorf("invalid permissions for nkey %q: %w", u.Nkey, err)
		}
	}
	return validateNoAuthUser(o, o.NoAuthUser)
}

func validatePermissionSubjects(p *Permissions) error {
	if p == nil {
		return nil
	}
	if p.Publish != nil {
		if err := checkPermSubjectArray(p.Publish.Allow, false); err != nil {
			return fmt.Errorf("publish allow: %w", err)
		}
		if err := checkPermSubjectArray(p.Publish.Deny, false); err != nil {
			return fmt.Errorf("publish deny: %w", err)
		}
	}
	if p.Subscribe != nil {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Inspect the wrapped error for the failing subject
2. Correct invalid publish/subscribe subjects in the nkey's permissions
3. Regenerate config after fixing subject wildcards or tokens

When it happens

Trigger: Thrown at server/auth.go:1723 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/d1bd45ba26ae9871. Report an issue: GitHub.