nats-io/nats-server · error

trusted Keys %q are required to be a valid public operator n

Error message

trusted Keys %q are required to be a valid public operator nkey

What it means

Options validation after collecting trusted keys from operator claims: a key appended to o.TrustedKeys (operator subject or signing key, or explicit trusted_keys) failed nkeys.IsValidPublicOperatorKey, so it cannot participate in operator-signature verification.

Source

Thrown at server/jwt.go:159

			return fmt.Errorf("operator %s expected update version %d > server update version %d",
				opc.Subject, update, srvUpdate)
		}
	}
	// If we have operators, fill in the trusted keys.
	// FIXME(dlc) - We had TrustedKeys before TrustedOperators. The jwt.OperatorClaims
	// has a DidSign(). Use that longer term. For now we can expand in place.
	for _, opc := range o.TrustedOperators {
		if o.TrustedKeys == nil {
			o.TrustedKeys = make([]string, 0, 4)
		}
		if !opc.StrictSigningKeyUsage {
			o.TrustedKeys = append(o.TrustedKeys, opc.Subject)
		}
		o.TrustedKeys = append(o.TrustedKeys, opc.SigningKeys...)
	}
	for _, key := range o.TrustedKeys {
		if !nkeys.IsValidPublicOperatorKey(key) {
			return fmt.Errorf("trusted Keys %q are required to be a valid public operator nkey", key)
		}
	}
	if len(o.resolverPinnedAccounts) > 0 {
		for key := range o.resolverPinnedAccounts {
			if !nkeys.IsValidPublicAccountKey(key) {
				return fmt.Errorf("pinned account key %q is not a valid public account nkey", key)
			}
		}
		// ensure the system account (belonging to the operator can always connect)
		if o.SystemAccount != _EMPTY_ {
			o.resolverPinnedAccounts[o.SystemAccount] = struct{}{}
		}
	}

	// If we have an auth callout defined make sure we are not in operator mode.
	if o.AuthCallout != nil {
		return errors.New("operators do not allow authorization callouts to be configured directly")
	}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Ensure trusted keys and operator signing keys are valid 'O'-type public nkeys
2. Regenerate the operator with proper nkeys
3. Remove mistyped entries from trusted_keys in the config

When it happens

Trigger: Thrown at server/jwt.go:159 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/a411e4706fba6e38. Report an issue: GitHub.