nats-io/nats-server · error

proxy trusted key %q is invalid

Error message

proxy trusted key %q is invalid

What it means

A trusted public key configured for proxies failed nkeys.IsValidPublicKey validation. Proxy trusted keys are ed25519-based NATS nkeys; the server validates each entry at startup to ensure proxy trust anchors are well-formed 56-character base32 keys beginning with a valid prefix.

Source

Thrown at server/auth.go:1803

		}
	}
	for _, u := range o.Nkeys {
		if u.Nkey == noAuthUser {
			return nil
		}
	}
	return fmt.Errorf(
		`no_auth_user: "%s" not present as user or nkey in authorization block or account configuration`,
		noAuthUser)
}

func validateProxies(o *Options) error {
	if o.Proxies == nil {
		return nil
	}
	for _, p := range o.Proxies.Trusted {
		if !nkeys.IsValidPublicKey(p.Key) {
			return fmt.Errorf("proxy trusted key %q is invalid", p.Key)
		}
	}
	return nil
}

// Create a list of nkeys.KeyPair corresponding to the public keys
// of the Proxies.TrustedKeys list.
// Server lock must be held on entry.
func (s *Server) processProxiesTrustedKeys() {
	// We could be here on reload.
	if s.proxiesKeyPairs != nil {
		s.proxiesKeyPairs = s.proxiesKeyPairs[:0]
	}
	if opts := s.getOpts(); opts.Proxies == nil {
		return
	}
	for _, p := range s.getOpts().Proxies.Trusted {
		// Can't fail since we have already checked that it was a valid key.

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Regenerate or re-copy the proxy trusted public nkey ensuring it is the full 56-character public key (starts with a valid nkey prefix).
2. Ensure you are using the public key, not the seed (S-prefixed) key.
3. Check the config for truncation, whitespace, or quoting issues.
4. Validate keys with `nkeys` CLI or a quick nkeys.IsValidPublicKey check before adding to config.

Example fix

// before
proxies { trusted: [ { key: "AB2C3D..." } ] }
// after
proxies { trusted: [ { key: "XB2C3D4E5F6G7H8I9J0K1L2M3N4O5P6Q7R8S9T0U1V2W3X4Y5Z6A7B" } ] }

for _, p := range opts.Proxies.Trusted {
    if !nkeys.IsValidPublicKey(p.Key) {
        return fmt.Errorf("invalid proxy key %q", p.Key)
    }
}

func isValidProxyKey(k string) bool { return nkeys.IsValidPublicKey(k) }

if err := validateOptions(opts); err != nil {
    if strings.Contains(err.Error(), "proxy trusted key") {
        log.Fatalf("fix proxy trusted nkey: %v", err)
    }
}

When it happens

Trigger: validateProxies iterates o.Proxies.Trusted and a Key value is not a valid nkey — wrong length, invalid base32 characters, wrong prefix, or an empty string.

Common situations: Copy/paste truncated keys, quoting errors in config, using a seed (starting with 'S') instead of the public key, or using an account/user nkey of the wrong kind where a proxy trust key is expected.

Related errors

• ack wait must be a positive value
• JS API timeout must be a positive value
• will only fetch valid account keys
• publish deny: %w
• subscribe allow: %w

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/4add8ab66dc79ca7. Report an issue: GitHub.