nats-io/nats-server · error

will only fetch valid account keys

Error message

will only fetch valid account keys

What it means

fetchAccount resolves an account JWT by account public key (nkey). Before calling the resolver it validates the name with nkeys.IsValidPublicAccountKey; anything that is not a valid 'A...' public account key is rejected with this error and never hits the resolver.

Source

Thrown at server/accounts.go:4151

	}

	// Now check for permissions.
	var p = buildPermissionsFromJwt(&uc.Permissions)
	if p == nil {
		nu.defaultPerms = true
		acc.mu.RLock()
		if acc.defaultPerms != nil {
			p = acc.defaultPerms.clone()
		}
		acc.mu.RUnlock()
	}
	nu.Permissions = p
	return nu
}

func fetchAccount(res AccountResolver, name string) (string, error) {
	if !nkeys.IsValidPublicAccountKey(name) {
		return _EMPTY_, fmt.Errorf("will only fetch valid account keys")
	}
	return res.Fetch(copyString(name))
}

// AccountResolver interface. This is to fetch Account JWTs by public nkeys
type AccountResolver interface {
	Fetch(name string) (string, error)
	Store(name, jwt string) error
	IsReadOnly() bool
	Start(server *Server) error
	IsTrackingUpdate() bool
	Reload() error
	Close()
}

// Default implementations of IsReadOnly/Start so only need to be written when changed
type resolverDefaultsOpsImpl struct{}

View on GitHub (pinned to 3a66a489d2)

Solutions

1. Ensure the account ID used is a valid public account nkey (starts with 'A', 57 chars, valid nkeys checksum)
2. Fix the account name in config/claims that triggers the resolver lookup
3. Pre-validate with nkeys.IsValidPublicAccountKey before calling the resolver

Example fix

// before
jwt, err := fetchAccount(resolver, "my-account")
// after
if !nkeys.IsValidPublicAccountKey("my-account") {
    return errors.New("account id must be a public account nkey")
}
jwt, err := fetchAccount(resolver, "AB25...KEY")

import "github.com/nats-io/nkeys"
if !nkeys.IsValidPublicAccountKey(accountID) {
    return fmt.Errorf("%q is not a valid public account key", accountID)
}

func isPublicAccountKey(s string) bool { return nkeys.IsValidPublicAccountKey(s) }

When it happens

Trigger: Calling fetchAccount (e.g. through an AccountResolver such as URLAccResolver or MemAccResolver) with a name that is empty, a user/operator nkey, an email, or any string that is not a valid public account nkey.

Common situations: Resolver configured with wrong account name in config; caller passes account name/alias instead of the public key; stale or corrupted account reference in operator tooling.

Related errors

• JS_ERR_GENERIC
• store operation not supported for URL Resolver
• could not fetch <%q>: %v
• could not fetch <%q>: no response
• delete must be enabled in server config

AI-assisted analysis of nats-io/nats-server@3a66a489d2 (2026-09-02). Data as JSON: /api/errors/4e5cfc50f2d9e18a. Report an issue: GitHub.