risingwavelabs/risingwave · error

failed to parse static creds

Error message

failed to parse static creds

What it means

Not a bail but an `.expect("failed to parse static creds")` panic path: after `create_credential` succeeds building a NATS static credential from nkey+jwt, `connect_options.credentials(...)` returned None, meaning the connect options rejected the credential. This indicates an internal inconsistency or incompatible async-nats version rather than user input error.

Source

Thrown at src/connector/src/connector_common/common.rs:1065

        match self.connect_mode.as_str() {
            "user_and_password" => {
                if let (Some(v_user), Some(v_password)) =
                    (self.user.as_ref(), self.password.as_ref())
                {
                    connect_options =
                        connect_options.user_and_password(v_user.into(), v_password.into())
                } else {
                    bail!(
                        "NATS connect mode `user_and_password` requires both `user` and `password`"
                    );
                }
            }

            "credential" => {
                if let (Some(v_nkey), Some(v_jwt)) = (self.nkey.as_ref(), self.jwt.as_ref()) {
                    connect_options = connect_options
                        .credentials(&self.create_credential(v_nkey, v_jwt)?)
                        .expect("failed to parse static creds")
                } else {
                    bail!("NATS connect mode `credential` requires both `nkey` and `jwt`");
                }
            }
            "plain" => {}
            _ => {
                bail!(
                    "NATS connect mode must be one of `user_and_password`, `credential`, or `plain`"
                );
            }
        };

        let servers = self.server_url.split(',').collect::<Vec<&str>>();
        let client = connect_options
            .connect(
                servers
                    .iter()
                    .map(|url| url.parse())

View on GitHub (pinned to 6469eb736d)

Solutions

1. Check the async-nats crate version matches what RisingWave expects (Cargo.lock) and rebuild.
2. Regenerate the nkey/jwt pair with the NATS CLI (`nsc`) and verify it with `nats` client login.
3. If reproducible, report as a bug — this expect indicates an internal invariant violation, not user error.

Example fix

// before
cargo update -p async-nats  // may pull incompatible version
// after
cargo update -p async-nats --precise <version-pinned-in-lockfile>

try { await createNatsSink(opts); } catch (e) {
  if (e.name === 'PanicError' || String(e).includes('failed to parse static creds')) {
    // async-nats rejected a well-formed credential; check versions and regenerate creds
    await verifyAsyncNatsVersion();
    throw new Error('Static NATS credential rejected by client; regenerate nkey/jwt or pin async-nats version');
  }
  throw e;
}

When it happens

Trigger: NATS `credential` connect mode with valid nkey and jwt where the async-nats `ConnectOptions::credentials` call unexpectedly returns None — typically an async-nats version/API mismatch or a credential the builder cannot accept.

Common situations: Workspace dependency upgrade of async-nats changing behavior of `credentials()`; constructing a credential whose format the installed client cannot consume.

Understand the failure class

Background: "This is a bug, please report it": internal invariant violations, unreachable panics, and SNH errors explained — this error's family across 47 libraries.

• Parsing and encoding errors: unexpected token, malformed input — why parsers reject input and how to find the real culprit.

Related errors

• unknown minimal compatible type for {a:?} and {b:?}
• unexpected statement type: {:?}
• OBS_ACCESS_KEY_ID not found from environment variables
• OBS_SECRET_ACCESS_KEY not found from environment variables
• OSS_ACCESS_KEY_ID not found from environment variables

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/5b7c75daff2bcbbb. Report an issue: GitHub.