nats-io/nats-server · error

invalid permissions for user %q: %w

Error message

invalid permissions for user %q: %w

What it means

Startup options validation: validatePermissionSubjects rejected the Permissions block (publish/subscribe allow/deny subject lists) for the named user in o.Users; the wrapped error identifies the exact subject problem.

Source

Thrown at server/auth.go:1715

		spass := stringToBytes(serverPassword)
		cpass := stringToBytes(clientPassword)
		if subtle.ConstantTimeCompare(spass, cpass) == 0 {
			return false
		}
	}
	return true
}

func validateAuth(o *Options) error {
	if err := validatePinnedCerts(o.TLSPinnedCerts); err != nil {
		return err
	}
	for _, u := range o.Users {
		if err := validateAllowedConnectionTypes(u.AllowedConnectionTypes); err != nil {
			return err
		}
		if err := validatePermissionSubjects(u.Permissions); err != nil {
			return fmt.Errorf("invalid permissions for user %q: %w", u.Username, err)
		}
	}
	for _, u := range o.Nkeys {
		if err := validateAllowedConnectionTypes(u.AllowedConnectionTypes); err != nil {
			return err
		}
		if err := validatePermissionSubjects(u.Permissions); err != nil {
			return fmt.Errorf("invalid permissions for nkey %q: %w", u.Nkey, err)
		}
	}
	return validateNoAuthUser(o, o.NoAuthUser)
}

func validatePermissionSubjects(p *Permissions) error {
	if p == nil {
		return nil
	}
	if p.Publish != nil {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Check the wrapped error for the offending subject
2. Fix invalid subject syntax in the user's permissions section of the config
3. Ensure subjects do not mix invalid wildcards or empty tokens

When it happens

Trigger: Thrown at server/auth.go:1715 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/a88fc2e2788a7e6b. Report an issue: GitHub.