What causes "no_auth_user: "%s" present, but users/nkeys are not defined" in nats-io/nats-server?

Add a user definition whose username matches the no_auth_user value.

no_auth_user: "%s" present, but users/nkeys are not defined

Error message

no_auth_user: "%s" present, but users/nkeys are not defined

What it means

The no_auth_user option names a user that is not defined anywhere: neither nkeys nor users are configured at all. The option requires that the referenced identity exists in the server's authorization/users/nkeys configuration so the server can apply its permissions to anonymous connections.

Source

Thrown at server/auth.go:1780

		}
		if ctuc != ct {
			delete(m, ct)
			m[ctuc] = struct{}{}
		}
	}
	return nil
}

func validateNoAuthUser(o *Options, noAuthUser string) error {
	if noAuthUser == _EMPTY_ {
		return nil
	}
	if len(o.TrustedOperators) > 0 {
		return fmt.Errorf("no_auth_user not compatible with Trusted Operator")
	}

	if o.Nkeys == nil && o.Users == nil {
		return fmt.Errorf(`no_auth_user: "%s" present, but users/nkeys are not defined`, noAuthUser)
	}
	for _, u := range o.Users {
		if u.Username == noAuthUser {
			return nil
		}
	}
	for _, u := range o.Nkeys {
		if u.Nkey == noAuthUser {
			return nil
		}
	}
	return fmt.Errorf(
		`no_auth_user: "%s" not present as user or nkey in authorization block or account configuration`,
		noAuthUser)
}

func validateProxies(o *Options) error {
	if o.Proxies == nil {

View on GitHub (pinned to 3a66a489d2)

Solutions

Add a user definition whose username matches the no_auth_user value.
Alternatively add an nkey entry matching no_auth_user.
Remove no_auth_user if anonymous access should be fully open or governed by operators.
Validate with `nats-server -t -c config` before deploying.

Example fix

// before
no_auth_user: guest
// after
no_auth_user: guest
accounts { APP { users = [ { user: guest, password: pwd } ] } }

Defensive patterns

Strategy: validation

Validate before calling

if opts.NoAuthUser != "" && len(opts.Users) == 0 && len(opts.Nkeys) == 0 {
    return errors.New("no_auth_user set but no users/nkeys defined")
}

Try / catch

if err := validateOptions(opts); err != nil {
    if strings.Contains(err.Error(), "users/nkeys are not defined") {
        log.Fatal("define the no_auth_user identity or remove the option")
    }
}

Prevention

Define the anonymous user in the same config section as no_auth_user
Lint configs with `nats-server -t` in CI
Avoid hand-removing users blocks without checking no_auth_user references

When it happens

Trigger: validateNoAuthUser is called with a non-empty no_auth_user while o.Nkeys == nil and o.Users == nil — i.e. no user or nkey definitions exist in the configuration to match against.

Common situations: Minimal config where no_auth_user was set but the users block was deleted or never defined; configs converted from open mode where all user definitions were removed; programmatic Options with only NoAuthUser set.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/6de584cdfb3e20cb. Report an issue: GitHub.