nats-io/nats-server · error

user JWT generated invalid permissions: %v

Error message

user JWT generated invalid permissions: %v

What it means

The scoped signing key that issued the auth callout user JWT declares a scope template, and expanding that scope produced permissions that failed validation — the generated permission subjects/signing requirements are invalid.

Source

Thrown at server/auth_callout.go:241

		}

		targetAcc, err := s.LookupAccount(placement)
		if err != nil {
			return nil, fmt.Errorf("no valid account %q for auth callout response on account %q: %v", placement, account, err)
		}
		if isOperatorMode {
			// this will validate the signing key that emitted the user, and if it is a signing
			// key it assigns the permissions from the target account
			if scope, ok := targetAcc.hasIssuer(arc.Issuer); !ok {
				return nil, fmt.Errorf("user JWT issuer %q is not known", arc.Issuer)
			} else if scope != nil {
				// this possibly has to be different because it could just be a plain issued by a non-scoped signing key
				if err := scope.ValidateScopedSigner(arc); err != nil {
					return nil, fmt.Errorf("user JWT is not valid: %v", err)
				} else if uSc, ok := scope.(*jwt.UserScope); !ok {
					return nil, fmt.Errorf("user JWT is not a valid scoped user")
				} else if arc.User.UserPermissionLimits, err = processUserPermissionsTemplate(uSc.Template, arc, targetAcc); err != nil {
					return nil, fmt.Errorf("user JWT generated invalid permissions: %v", err)
				}
			}
		}
		return targetAcc, nil
	}

	processReply := func(_ *subscription, rc *client, racc *Account, subject, reply string, rmsg []byte) {
		arc, err := decodeResponse(rc, rmsg, racc)
		if err != nil {
			c.authViolation()
			respCh <- titleCase(err.Error())
			return
		}
		// If the caller had established that the user should go through a proxy,
		// or if the `arc` JWT requires it, and we don't have a trusted proxy,
		// reject the connection.
		if (proxyRequired || arc.ProxyRequired) && !trustedProxy {
			err = ErrAuthProxyRequired

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Fix the scope template on the signing key in account claims
2. Ensure template operations and tags referenced in the scope are defined
3. Re-sign the account with corrected scope settings

When it happens

Trigger: Thrown at server/auth_callout.go:241 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/ba494451f3357eb2. Report an issue: GitHub.