nats-io/nats-server · error

unable to get seed: %v

Error message

unable to get seed: %v

What it means

nkeys user.Seed() failed to return the seed string for the newly created user key. Although CreateUser succeeded, extracting the seed bytes failed, so there is no JetStream encryption key string to seal into the TPM.

Source

Thrown at server/tpm/js_ek_tpm_windows.go:163

user, err := nkeys.CreateUser()
if err != nil {
	return "", fmt.Errorf("unable to create seed: %v", err)
}
// We'll use the seed to represent the encryption key.
jsStoreKey, err := user.Seed()
if err != nil {
	return "", fmt.Errorf("unable to get seed: %v", err)
}
privateArea, publicArea, err := tpm2.Seal(rwc, srkHandle, srkPassword, jsKeyPassword, policy, jsStoreKey)
if err != nil {
	return "", fmt.Errorf("unable to seal data: %v", err)
}

View on GitHub (pinned to 3a66a489d2)

Solutions

  1. Retry key creation; the failure is normally transient
  2. Check the nkeys library version for known Seed() issues
  3. If persistent, regenerate after verifying system entropy
Defensive patterns

Strategy: retry

When it happens

Trigger: Thrown at server/tpm/js_ek_tpm_windows.go:163 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/aed3f6d672eb1068. Report an issue: GitHub.