risingwavelabs/risingwave · error · ConnectorError

NATS connect mode `credential` requires both `nkey` and `jwt

Error message

NATS connect mode `credential` requires both `nkey` and `jwt`

What it means

Thrown in the NATS connect-options builder when `connect_mode = 'credential'` is selected but either `nkey` or `jwt` (or both) is absent. Static NATS credentials are composed of both an nkey and a JWT account token; one without the other is unusable.

Source

Thrown at src/connector/src/connector_common/common.rs:1067

                if let (Some(v_user), Some(v_password)) =
                    (self.user.as_ref(), self.password.as_ref())
                {
                    connect_options =
                        connect_options.user_and_password(v_user.into(), v_password.into())
                } else {
                    bail!(
                        "NATS connect mode `user_and_password` requires both `user` and `password`"
                    );
                }
            }

            "credential" => {
                if let (Some(v_nkey), Some(v_jwt)) = (self.nkey.as_ref(), self.jwt.as_ref()) {
                    connect_options = connect_options
                        .credentials(&self.create_credential(v_nkey, v_jwt)?)
                        .expect("failed to parse static creds")
                } else {
                    bail!("NATS connect mode `credential` requires both `nkey` and `jwt`");
                }
            }
            "plain" => {}
            _ => {
                bail!(
                    "NATS connect mode must be one of `user_and_password`, `credential`, or `plain`"
                );
            }
        };

        let servers = self.server_url.split(',').collect::<Vec<&str>>();
        let client = connect_options
            .connect(
                servers
                    .iter()
                    .map(|url| url.parse())
                    .collect::<Result<Vec<async_nats::ServerAddr>, _>>()?,
            )

View on GitHub (pinned to 6469eb736d)

Solutions

  1. Provide both `nkey` and `jwt` fields in the connector properties.
  2. Generate the pair via `nsc` (e.g. `nsc generate creds`) and supply both parts as secrets.
  3. If you meant username/password auth, switch `connect_mode = 'user_and_password'` instead.

Example fix

// before
WITH (connect_mode = 'credential', jwt = 'eyJ...') -- nkey missing
// after
WITH (connect_mode = 'credential', nkey = 'UD...', jwt = 'eyJ...')
Defensive patterns

Strategy: validation

Validate before calling

function validateNatsCredMode(props) {
  if (props.connect_mode === 'credential') {
    if (!props.nkey || !props.jwt) throw new Error('credential mode requires both nkey and jwt');
  }
}
validateNatsCredMode(withOptions);

Type guard

const hasNkeyJwt = (p) => typeof p.nkey === 'string' && p.nkey.length > 0 && typeof p.jwt === 'string' && p.jwt.length > 0;

Try / catch

try { await createNatsSink(opts); } catch (e) { if (String(e).includes('requires both `nkey` and `jwt`')) throw new Error('Provide both nkey and jwt (nsc generate creds) for connect_mode = credential'); throw e; }

Prevention

When it happens

Trigger: Configuring a NATS source/sink with `connect_mode = 'credential'` while omitting `nkey` or `jwt` from the properties.

Common situations: Only the JWT was provisioned from the NATS operator and the nkey forgotten; secrets mounted partially; confusing `credential` mode with `user_and_password` mode fields.

Understand the failure class

Background: "is required", "must be set", "missing required field": configuration validation errors across open-source libraries — this error's family across 36 libraries.

Related errors

AI-assisted analysis of risingwavelabs/risingwave@6469eb736d (2026-09-11). Data as JSON: /api/errors/4f63e4c358fd19e3. Report an issue: GitHub.