nats-io/nats-server · error

pinned account key %q is not a valid public account nkey

Error message

pinned account key %q is not a valid public account nkey

What it means

Options validation for resolver pinned accounts: a key in resolverPinnedAccounts failed nkeys.IsValidPublicAccountKey, so it cannot be used to pin which accounts the resolver will fetch.

Source

Thrown at server/jwt.go:165

	// has a DidSign(). Use that longer term. For now we can expand in place.
	for _, opc := range o.TrustedOperators {
		if o.TrustedKeys == nil {
			o.TrustedKeys = make([]string, 0, 4)
		}
		if !opc.StrictSigningKeyUsage {
			o.TrustedKeys = append(o.TrustedKeys, opc.Subject)
		}
		o.TrustedKeys = append(o.TrustedKeys, opc.SigningKeys...)
	}
	for _, key := range o.TrustedKeys {
		if !nkeys.IsValidPublicOperatorKey(key) {
			return fmt.Errorf("trusted Keys %q are required to be a valid public operator nkey", key)
		}
	}
	if len(o.resolverPinnedAccounts) > 0 {
		for key := range o.resolverPinnedAccounts {
			if !nkeys.IsValidPublicAccountKey(key) {
				return fmt.Errorf("pinned account key %q is not a valid public account nkey", key)
			}
		}
		// ensure the system account (belonging to the operator can always connect)
		if o.SystemAccount != _EMPTY_ {
			o.resolverPinnedAccounts[o.SystemAccount] = struct{}{}
		}
	}

	// If we have an auth callout defined make sure we are not in operator mode.
	if o.AuthCallout != nil {
		return errors.New("operators do not allow authorization callouts to be configured directly")
	}

	return nil
}

func validateSrc(claims *jwt.UserClaims, host string) bool {
	if claims == nil {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Use valid 'A'-prefixed account public keys in the pinned accounts list
2. Remove mistyped keys from resolver_pinned_accounts
3. Regenerate keys with nkeys if corrupted

When it happens

Trigger: Thrown at server/jwt.go:165 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/51fbd5d94264478c. Report an issue: GitHub.