nats-io/nats-server · error

key to merge is not a valid public account key

Error message

key to merge is not a valid public account key

What it means

DirJWTStore.Merge: the pubKey part of a package line failed nkeys.IsValidPublicAccountKey, meaning it is not a well-formed account public key (must be an 'A'-prefixed 56-char nkey).

Source

Thrown at server/dirstore.go:333

	return err
}

// Merge takes the JWTs from package and adds them to the store
// Merge is destructive in the sense that it doesn't check if the JWT
// is newer or anything like that.
func (store *DirJWTStore) Merge(pack string) error {
	newJWTs := strings.Split(pack, "\n")
	for _, line := range newJWTs {
		if line == _EMPTY_ { // ignore blank lines
			continue
		}
		split := strings.Split(line, "|")
		if len(split) != 2 {
			return fmt.Errorf("line in package didn't contain 2 entries: %q", line)
		}
		pubKey := split[0]
		if !nkeys.IsValidPublicAccountKey(pubKey) {
			return fmt.Errorf("key to merge is not a valid public account key")
		}
		if err := store.saveIfNewer(pubKey, split[1]); err != nil {
			return err
		}
	}
	return nil
}

func (store *DirJWTStore) Reload() error {
	store.Lock()
	exp := store.expiration
	if exp == nil || store.readonly {
		store.Unlock()
		return nil
	}
	idx := exp.idx
	changed := store.changed
	isCache := store.expiration.evictOnLimit

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Use the account's real public nkey as the first field
2. Re-export the package with correct keys
3. Check for copy/paste corruption of the key

When it happens

Trigger: Thrown at server/dirstore.go:333 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/8160fe01719024d2. Report an issue: GitHub.