no_auth_user: "%s" not present as user or nkey in authorizat

Error message

no_auth_user: "%s" not present as user or nkey in authorization block or account configuration

What it means

The no_auth_user option names an identity that was not found among the configured users or nkeys. For no_auth_user to work, it must exactly match a username in the authorization block, an account's user list, or an nkey entry, so the server can borrow those credentials for anonymous clients.

Source

Thrown at server/auth.go:1792

	}
	if len(o.TrustedOperators) > 0 {
		return fmt.Errorf("no_auth_user not compatible with Trusted Operator")
	}

	if o.Nkeys == nil && o.Users == nil {
		return fmt.Errorf(`no_auth_user: "%s" present, but users/nkeys are not defined`, noAuthUser)
	}
	for _, u := range o.Users {
		if u.Username == noAuthUser {
			return nil
		}
	}
	for _, u := range o.Nkeys {
		if u.Nkey == noAuthUser {
			return nil
		}
	}
	return fmt.Errorf(
		`no_auth_user: "%s" not present as user or nkey in authorization block or account configuration`,
		noAuthUser)
}

func validateProxies(o *Options) error {
	if o.Proxies == nil {
		return nil
	}
	for _, p := range o.Proxies.Trusted {
		if !nkeys.IsValidPublicKey(p.Key) {
			return fmt.Errorf("proxy trusted key %q is invalid", p.Key)
		}
	}
	return nil
}

// Create a list of nkeys.KeyPair corresponding to the public keys
// of the Proxies.TrustedKeys list.

View on GitHub (pinned to 3a66a489d2)

Solutions

Make no_auth_user exactly match an existing username or nkey public key in the config.
Check spelling, case, and whitespace of both no_auth_user and the user/nkey entries.
Confirm the config file actually defines the user (not commented out) and reload the server.
Remove no_auth_user if anonymous access is not needed.

Example fix

// before
no_auth_user: Guest
users = [ { user: guest, password: pwd } ]
// after
no_auth_user: guest
users = [ { user: guest, password: pwd } ]

Defensive patterns

Strategy: validation

Validate before calling

found := false
for _, u := range opts.Users { if u.Username == opts.NoAuthUser { found = true } }
for _, n := range opts.Nkeys { if n.Nkey == opts.NoAuthUser { found = true } }
if opts.NoAuthUser != "" && !found { return fmt.Errorf("%q not found", opts.NoAuthUser) }

Try / catch

if err := validateOptions(opts); err != nil {
    if strings.Contains(err.Error(), "not present as user or nkey") {
        log.Fatalf("no_auth_user mismatch: %v", err)
    }
}

Prevention

Keep no_auth_user value copied verbatim from the users entry
Check case and whitespace on both sides
Verify the user's config section isn't commented out
Use `nats-server -t` to catch it before startup

When it happens

Trigger: validateNoAuthUser completes the loops over o.Users and o.Nkeys without finding a Username/Nkey equal to noAuthUser, then returns this error. Typical when the name is misspelled, defined only in an account not loaded, or has different case.

Common situations: Typo between no_auth_user and the users entry, user defined in a config section that failed to load or was removed, whitespace/case mismatch, or user defined only inside an account while server-level check expected it in the authorization block.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/df6116c5c48ca604. Report an issue: GitHub.