nats-io/nats-server · error

user JWT is not a valid scoped user

Error message

user JWT is not a valid scoped user

What it means

Auth callout response processing in operator mode: the returned user JWT was issued by a signing key with a scope, and scope validation determined the JWT is not a valid scoped-to-user JWT (wrong claims/signature for scoped access).

Source

Thrown at server/auth_callout.go:239

		} else {
			placement = issuerAccount
		}

		targetAcc, err := s.LookupAccount(placement)
		if err != nil {
			return nil, fmt.Errorf("no valid account %q for auth callout response on account %q: %v", placement, account, err)
		}
		if isOperatorMode {
			// this will validate the signing key that emitted the user, and if it is a signing
			// key it assigns the permissions from the target account
			if scope, ok := targetAcc.hasIssuer(arc.Issuer); !ok {
				return nil, fmt.Errorf("user JWT issuer %q is not known", arc.Issuer)
			} else if scope != nil {
				// this possibly has to be different because it could just be a plain issued by a non-scoped signing key
				if err := scope.ValidateScopedSigner(arc); err != nil {
					return nil, fmt.Errorf("user JWT is not valid: %v", err)
				} else if uSc, ok := scope.(*jwt.UserScope); !ok {
					return nil, fmt.Errorf("user JWT is not a valid scoped user")
				} else if arc.User.UserPermissionLimits, err = processUserPermissionsTemplate(uSc.Template, arc, targetAcc); err != nil {
					return nil, fmt.Errorf("user JWT generated invalid permissions: %v", err)
				}
			}
		}
		return targetAcc, nil
	}

	processReply := func(_ *subscription, rc *client, racc *Account, subject, reply string, rmsg []byte) {
		arc, err := decodeResponse(rc, rmsg, racc)
		if err != nil {
			c.authViolation()
			respCh <- titleCase(err.Error())
			return
		}
		// If the caller had established that the user should go through a proxy,
		// or if the `arc` JWT requires it, and we don't have a trusted proxy,
		// reject the connection.

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Ensure the auth callout service signs responses with a proper scoped signing key
2. Check the user JWT includes the required scope fields
3. Re-issue the user JWT from the account's signing keys

When it happens

Trigger: Thrown at server/auth_callout.go:239 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/ce00a4bcf4f28e20. Report an issue: GitHub.