nats-io/nats-server · warning

reserved account

Error message

reserved account

What it means

ErrReservedAccount represents an attempt to create an account whose name is reserved by the server (reserved account names cannot be used as regular accounts). In the current source tree it is declared in server/errors.go:108 but has no call sites, so it is reserved for future/internal enforcement of reserved account identifiers.

Source

Thrown at server/errors.go:108

	// and it has the same cluster name as the hub cluster.
	ErrLeafNodeHasSameClusterName = errors.New("remote leafnode has same cluster name")

	// ErrLeafNodeDisabled is when we disable leafnodes.
	ErrLeafNodeDisabled = errors.New("leafnodes disabled")

	// ErrConnectedToWrongPort represents an error condition when a connection is attempted
	// to the wrong listen port (for instance a LeafNode to a client port, etc...)
	ErrConnectedToWrongPort = errors.New("attempted to connect to wrong port")

	// ErrAccountExists is returned when an account is attempted to be registered
	// but already exists.
	ErrAccountExists = errors.New("account exists")

	// ErrBadAccount represents a malformed or incorrect account.
	ErrBadAccount = errors.New("bad account")

	// ErrReservedAccount represents a reserved account that can not be created.
	ErrReservedAccount = errors.New("reserved account")

	// ErrMissingAccount is returned when an account does not exist.
	ErrMissingAccount = errors.New("account missing")

	// ErrMissingService is returned when an account does not have an exported service.
	ErrMissingService = errors.New("service missing")

	// ErrBadServiceType is returned when latency tracking is being applied to non-singleton response types.
	ErrBadServiceType = errors.New("bad service response type")

	// ErrBadSampling is returned when the sampling for latency tracking is not 1 >= sample <= 100.
	ErrBadSampling = errors.New("bad sampling percentage, should be 1-100")

	// ErrAccountValidation is returned when an account has failed validation.
	ErrAccountValidation = errors.New("account validation failed")

	// ErrAccountExpired is returned when an account has expired.
	ErrAccountExpired = errors.New("account expired")

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Choose a non-reserved account name for user-defined accounts
2. Keep internal/system accounts managed by the server itself rather than creating them manually
3. Check the server version's documentation for the list of reserved account names

Example fix

// before
acc, _ := server.NewAccount("$SYS") // reserved
s.RegisterAccount(acc)
// after
acc, _ := server.NewAccount("my-app")
s.RegisterAccount(acc)

reserved := map[string]bool{"$SYS": true, "$G": true}
if reserved[accountName] { return fmt.Errorf("account name %q is reserved", accountName) }

func isReservedAccountName(name string) bool {
    return strings.HasPrefix(name, "$")
}

if _, err := s.RegisterAccount(acc); err != nil {
    if errors.Is(err, server.ErrReservedAccount) { /* pick another name */ }
    return err
}

When it happens

Trigger: Attempting to register or create an account using a name the server reserves for internal use (in current code paths this error is not yet returned; it exists as a sentinel for reserved-name enforcement).

Common situations: Trying to create accounts with well-known internal names (like system account identifiers) via account resolvers or embedded server APIs; forward-compatibility with server versions that do enforce reserved names.

Related errors

• account exists
• bad account
• account missing
• account jwt not found
• auth callout violation: auth callout response is not for exp

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/b9783515688b1424. Report an issue: GitHub.