nats-io/nats-server · error

operator mode requires account nkeys in remotes. Please add

Error message

operator mode requires account nkeys in remotes. Please add an `account` key to each remote in your `leafnodes` section, to assign it to an account. Each account value should be a 56 character public key, starting with the letter 'A'

What it means

Error "operator mode requires account nkeys in remotes. Please add an `account` key to each remote in your `leafnodes` section, to assign it to an account. Each account value should be a 56 character public key, starting with the letter 'A'" thrown in nats-io/nats-server.

Source

Thrown at server/leafnode.go:275

			if lu.Account == nil { // means global account
				continue
			}
			if err := checkAccountExists(lu.Account.Name, "authorization"); err != nil {
				return err
			}
		}
		for _, r := range o.LeafNode.Remotes {
			if err := checkAccountExists(r.LocalAccount, "remote"); err != nil {
				return err
			}
		}
	} else {
		if len(o.LeafNode.Users) != 0 {
			return fmt.Errorf("operator mode does not allow specifying users in leafnode config")
		}
		for _, r := range o.LeafNode.Remotes {
			if !nkeys.IsValidPublicAccountKey(r.LocalAccount) {
				return fmt.Errorf(
					"operator mode requires account nkeys in remotes. " +
						"Please add an `account` key to each remote in your `leafnodes` section, to assign it to an account. " +
						"Each account value should be a 56 character public key, starting with the letter 'A'")
			}
		}
		if o.LeafNode.Port != 0 && o.LeafNode.Account != "" && !nkeys.IsValidPublicAccountKey(o.LeafNode.Account) {
			return fmt.Errorf("operator mode and non account nkeys are incompatible")
		}
	}

	// Validate compression settings
	if o.LeafNode.Compression.Mode != _EMPTY_ {
		if err := validateAndNormalizeCompressionOption(&o.LeafNode.Compression, CompressionS2Auto); err != nil {
			return err
		}
	}

	// If a remote has a websocket scheme, all need to have it.

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Add an account key to each remote: leafnodes { remotes [ { urls: [...], account: "<A...>" } ] }
2. Generate a valid account nkey pair and use its public key
3. Ensure each account value is a 56-character public key starting with 'A'

When it happens

Trigger: Thrown at server/leafnode.go:275 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/3b9675534acb08f2. Report an issue: GitHub.