nats-io/nats-server · error

operator mode and non account nkeys are incompatible

Error message

operator mode and non account nkeys are incompatible

What it means

Leafnode operator-mode validation: a leafnode user entry specifies a password/username (non-nkey credentials), which cannot coexist with operator mode where authentication must be nkey/JWT based.

Source

Thrown at server/leafnode.go:282

		for _, r := range o.LeafNode.Remotes {
			if err := checkAccountExists(r.LocalAccount, "remote"); err != nil {
				return err
			}
		}
	} else {
		if len(o.LeafNode.Users) != 0 {
			return fmt.Errorf("operator mode does not allow specifying users in leafnode config")
		}
		for _, r := range o.LeafNode.Remotes {
			if !nkeys.IsValidPublicAccountKey(r.LocalAccount) {
				return fmt.Errorf(
					"operator mode requires account nkeys in remotes. " +
						"Please add an `account` key to each remote in your `leafnodes` section, to assign it to an account. " +
						"Each account value should be a 56 character public key, starting with the letter 'A'")
			}
		}
		if o.LeafNode.Port != 0 && o.LeafNode.Account != "" && !nkeys.IsValidPublicAccountKey(o.LeafNode.Account) {
			return fmt.Errorf("operator mode and non account nkeys are incompatible")
		}
	}

	// Validate compression settings
	if o.LeafNode.Compression.Mode != _EMPTY_ {
		if err := validateAndNormalizeCompressionOption(&o.LeafNode.Compression, CompressionS2Auto); err != nil {
			return err
		}
	}

	// If a remote has a websocket scheme, all need to have it.
	for _, rcfg := range o.LeafNode.Remotes {
		// Validate proxy configuration
		if _, err := validateLeafNodeProxyOptions(rcfg); err != nil {
			return err
		}

		if len(rcfg.URLs) >= 2 {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Replace username/password leafnode users with nkey users
2. Remove password credentials from leafnode users in operator mode
3. Use operator-signed JWTs for leafnode authentication

When it happens

Trigger: Thrown at server/leafnode.go:282 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/8fc5b969a38deabb. Report an issue: GitHub.