What causes "store operation not supported for URL Resolver" in nats-io/nats-server?

Use a memory resolver or directory-based resolver if JWTs must be stored/pushed to the server

store operation not supported for URL Resolver

Error message

store operation not supported for URL Resolver

What it means

The default resolver ops used with URL-based account resolvers are read-only: a URL resolver fetches JWTs over HTTP but cannot persist them. Any attempt to Store an account JWT through it returns this error unconditionally.

Source

Thrown at server/accounts.go:4190

}

func (*resolverDefaultsOpsImpl) IsTrackingUpdate() bool {
	return false
}

func (*resolverDefaultsOpsImpl) Start(*Server) error {
	return nil
}

func (*resolverDefaultsOpsImpl) Reload() error {
	return nil
}

func (*resolverDefaultsOpsImpl) Close() {
}

func (*resolverDefaultsOpsImpl) Store(_, _ string) error {
	return fmt.Errorf("store operation not supported for URL Resolver")
}

// MemAccResolver is a memory only resolver.
// Mostly for testing.
type MemAccResolver struct {
	sm sync.Map
	resolverDefaultsOpsImpl
}

// Fetch will fetch the account jwt claims from the internal sync.Map.
func (m *MemAccResolver) Fetch(name string) (string, error) {
	if j, ok := m.sm.Load(name); ok {
		return j.(string), nil
	}
	return _EMPTY_, ErrMissingAccount
}

// Store will store the account jwt claims in the internal sync.Map.

View on GitHub (pinned to 3a66a489d2)

Solutions

Use a memory resolver or directory-based resolver if JWTs must be stored/pushed to the server
With a URL resolver, serve updated JWTs from the HTTP endpoint instead of pushing them to the server
Gate the store call: only attempt Store when the resolver supports it

Example fix

// before
// server.conf: resolver: URL(http://localhost/acc/)  + tooling calls Store
// after
// server.conf: resolver: MEMORY (or resolver dir) if you need Store, or serve updated JWTs at the URL endpoint

Defensive patterns

Strategy: validation

Validate before calling

if _, isURL := resolver.(*URLAccResolver); isURL {
    return errors.New("URL resolver is read-only; serve updated JWTs from the HTTP endpoint instead")
}
if err := resolver.Store(name, jwt); err != nil { ... }

Try / catch

if err := resolver.Store(name, jwt); err != nil {
    if strings.Contains(err.Error(), "store operation not supported") {
        // fall back to serving JWTs via the URL endpoint
    }
}

Prevention

Match resolver type to tooling: use memory/dir resolver when pushing JWTs
Document that URL resolvers are fetch-only
Switch config deliberately before enabling push tooling

When it happens

Trigger: Calling Store on resolverDefaultsOpsImpl, i.e. invoking the AccountResolver store path when the server is configured with a URL resolver (resolver: URL / resolver URL) rather than a memory resolver or full resolver with a store directory.

Common situations: Server started with 'resolver: URL(...)' but operator tooling or account-update publish path tries to push/update account claims via the resolver; config switch from memory resolver to URL resolver while tooling still calls Store.

Related errors

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/0b86b1647516d896. Report an issue: GitHub.