nats-io/nats-server · error

stream import not authorized

Error message

stream import not authorized

What it means

ErrStreamImportAuthorization is returned when a stream import is not authorized: the importing account has not authorized the subject being imported, i.e. account.checkStreamImportAuthorized fails for the source account, subject, and claim. The library refuses to add an import that the exporting account's exports/claims do not permit.

Source

Thrown at server/errors.go:138

	ErrBadSampling = errors.New("bad sampling percentage, should be 1-100")

	// ErrAccountValidation is returned when an account has failed validation.
	ErrAccountValidation = errors.New("account validation failed")

	// ErrAccountExpired is returned when an account has expired.
	ErrAccountExpired = errors.New("account expired")

	// ErrNoAccountResolver is returned when we attempt an update but do not have an account resolver.
	ErrNoAccountResolver = errors.New("account resolver missing")

	// ErrAccountResolverUpdateTooSoon is returned when we attempt an update too soon to last request.
	ErrAccountResolverUpdateTooSoon = errors.New("account resolver update too soon")

	// ErrAccountResolverSameClaims is returned when same claims have been fetched.
	ErrAccountResolverSameClaims = errors.New("account resolver no new claims")

	// ErrStreamImportAuthorization is returned when a stream import is not authorized.
	ErrStreamImportAuthorization = errors.New("stream import not authorized")

	// ErrStreamImportBadPrefix is returned when a stream import prefix contains wildcards.
	ErrStreamImportBadPrefix = errors.New("stream import prefix can not contain wildcard tokens")

	// ErrStreamImportDuplicate is returned when a stream import is a duplicate of one that already exists.
	ErrStreamImportDuplicate = errors.New("stream import already exists")

	// ErrServiceImportAuthorization is returned when a service import is not authorized.
	ErrServiceImportAuthorization = errors.New("service import not authorized")

	// ErrImportFormsCycle is returned when an import would form a cycle.
	ErrImportFormsCycle = errors.New("import forms a cycle")

	// ErrCycleSearchDepth is returned when we have exceeded our maximum search depth..
	ErrCycleSearchDepth = errors.New("search cycle depth exhausted")

	// ErrClientOrRouteConnectedToGatewayPort represents an error condition when
	// a client or route attempted to connect to the Gateway port.

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Ensure the source account exports the subject (AddStreamExport or claim) and that the subject matches the import
2. If the export is private, generate a valid activation token for the importing account and pass it as the import claim
3. Regenerate expired/revoked activation tokens (nsc generate activation) and re-add the import
4. Verify account claims are up to date on both accounts before re-attempting the import

Example fix

// before
acc.AddStreamImport(fooAcc, "foo", "") // fooAcc export is private, no token
// after
tok := genActivationFor(fooAcc, "foo", importAcc) // valid activation claim
err := importAcc.AddStreamImport(fooAcc, "foo", tok)

// before importing, confirm the export exists and covers the subject
exports := fromAcc.Exports // via claims
if !exportCoversSubject(exports, from) { return errors.New("subject not exported by source account") }
if isPrivateExport(exports, from) && imClaim == nil { return errors.New("private export requires activation token") }

func importAuthorized(from *Account, subject string, claim *jwt.ActivationClaims) bool {
	return from.checkStreamImportAuthorized(fromAccCtx, subject, claim) == nil
}

if err := acc.AddStreamImport(fromAcc, subject, tok); err != nil {
	if errors.Is(err, ErrStreamImportAuthorization) { /* regenerate activation token or fix exports */ }
}

When it happens

Trigger: AddStreamImport (both the standard and prefix variants at accounts.go:2711 and 2747) where the from-account's exports do not cover the subject or the export requires an activation token (imClaim) that is missing/invalid for this importing account.

Common situations: Importing a subject the other account never exported; using an activation token issued for a different account or subject; expired/revoked activation tokens; export marked private and no token supplied; subject pattern mismatch between export and import.

Related errors

• stream import prefix can not contain wildcard tokens
• service missing
• bad service response type
• bad sampling percentage, should be 1-100
• account validation failed

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/83bf4dd4e804dbb9. Report an issue: GitHub.