nats-io/nats-server · error

unknown connection type %q

Error message

unknown connection type %q

What it means

A connection_type in the operator's allowed_connection_types map was not recognized after normalization. The library validates each entry against the known jwt connection types (standard, websocket, leafnode, leafnode_ws, mqtt, mqtt_ws, in_process) and rejects unknown ones with this error.

Source

Thrown at server/auth.go:1761

			return fmt.Errorf("subscribe allow: %w", err)
		}
		if err := checkPermSubjectArray(p.Subscribe.Deny, true); err != nil {
			return fmt.Errorf("subscribe deny: %w", err)
		}
	}
	return nil
}

func validateAllowedConnectionTypes(m map[string]struct{}) error {
	for ct := range m {
		ctuc := strings.ToUpper(ct)
		switch ctuc {
		case jwt.ConnectionTypeStandard, jwt.ConnectionTypeWebsocket,
			jwt.ConnectionTypeLeafnode, jwt.ConnectionTypeLeafnodeWS,
			jwt.ConnectionTypeMqtt, jwt.ConnectionTypeMqttWS,
			jwt.ConnectionTypeInProcess:
		default:
			return fmt.Errorf("unknown connection type %q", ct)
		}
		if ctuc != ct {
			delete(m, ct)
			m[ctuc] = struct{}{}
		}
	}
	return nil
}

func validateNoAuthUser(o *Options, noAuthUser string) error {
	if noAuthUser == _EMPTY_ {
		return nil
	}
	if len(o.TrustedOperators) > 0 {
		return fmt.Errorf("no_auth_user not compatible with Trusted Operator")
	}

	if o.Nkeys == nil && o.Users == nil {

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Correct the connection type key to a known value: standard, websocket, leafnode, leafnode_ws, mqtt, mqtt_ws, in_process.
2. Check the server version — upgrade nats-server if the type comes from a newer tool release.
3. Remove the unknown entry from allowed_connection_types.
4. Regenerate the operator JWT with a matching current nsc version.

Example fix

// before
connection_types: ["websocket", "grpc"]
// after
connection_types: ["websocket", "standard"]

validTypes := map[string]bool{"standard":true,"websocket":true,"leafnode":true,"leafnode_ws":true,"mqtt":true,"mqtt_ws":true,"in_process":true}
for ct := range connTypes {
    if !validTypes[ct] { return fmt.Errorf("unknown connection type %q", ct) }
}

if err := validateAllowedConnectionTypes(m); err != nil {
    log.Fatalf("fix connection_types in operator settings: %v", err)
}

When it happens

Trigger: Config or operator JWT validation where validateAllowedConnectionTypes receives a map containing a key that doesn't map to a known jwt.ConnectionType value, e.g. a typo like 'websocket' vs accepted forms, or an entry from an operator JWT created by an unknown/newer tool.

Common situations: Typo in connection_types section of operator settings, hand-edited connection types, or an operator JWT generated by a newer NATS tool introducing a type this server version doesn't know (version mismatch).

Related errors

• no operator key found
• publish deny: %w
• subscribe allow: %w
• subscribe deny: %w
• no_auth_user not compatible with Trusted Operator

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/93a63784fe45dea5. Report an issue: GitHub.