Example JWT setup from the docs is not working.. at all.

[tbalbers]

I'm trying to do what is described here: https://docs.nats.io/using-nats/nats-tools/nsc/basics#account-server-configuration

But when I try to e.g. do a nsc push, I get:

tonalb@nlx000013:~/N/NATS-NSC$ nsc push -a sentinel -u nats://localhost:8222
[ERR ] push to nats-server "nats://localhost:8222" using system account "SYS":
       [ERR ] push sentinel to nats-server with nats account resolver:
              [ERR ] failed to get response to push account: nats: timeout
              [ OK ] pushed to a total of 0 nats-server
Error: all jobs failed
tonalb@nlx000013:~/N/NATS-NSC$

Which is pretty weird, the nats server is running on port 8222 and even with trace and debug enabled it doesn't tell me anything:

tonalb@nlx000013:~/N/NATS-NSC$ nats-server -c myconfig.conf -DV
[53546] 2026/02/19 15:48:36.639751 [INF] Starting nats-server version 1.4.1
[53546] 2026/02/19 15:48:36.639818 [DBG] Go build version go1.26.0
[53546] 2026/02/19 15:48:36.639826 [INF] Git commit [not set]
[53546] 2026/02/19 15:48:36.639965 [INF] Starting http monitor on 127.0.0.1:9222
[53546] 2026/02/19 15:48:36.640038 [INF] Listening for client connections on 127.0.0.1:8222
[53546] 2026/02/19 15:48:36.640045 [DBG] Server id is Wtxfpwdin8bKK5eGDpyDJE
[53546] 2026/02/19 15:48:36.640055 [INF] Server is ready
[53546] 2026/02/19 15:48:53.508558 [DBG] 127.0.0.1:56862 - cid:1 - Client connection created
[53546] 2026/02/19 15:48:53.509390 [TRC] 127.0.0.1:56862 - cid:1 - ->> [CONNECT {"verbose":false,"pedantic":false,"jwt":"eyJ0eXAiOiJKV1QiLCJhbGciOiJlZDI1NTE5LW5rZXkifQ.eyJleHAiOjE3NzE1MTI2NTMsImp0aSI6IlVEUlRDTFRRVEFHR1FFU1NPNk9YRUhGVklLVlY1RUhDSFlHR1dXWTUyMjc0QklPNktYSFEiLCJpYXQiOjE3NzE1MTI1MzMsImlzcyI6IkFEVkVBSTRKWERKWEM0UUk2WEdQVjZMQ0xDS0tVUkNCV0RWTlhNUTZQR1JZWFVTWVpHUUMzTENBIiwibmFtZSI6Im5zYyB0ZW1wb3JhcnkgcHVzaCB1c2VyIiwic3ViIjoiVUNNTUo0UUpDUEFSVTJITVhESktLVE9BNEFGRTZZVkVGVlM1V0Y0SFZZU1YyWFpJM0gzSElVSksiLCJuYXRzIjp7InB1YiI6eyJhbGxvdyI6WyIkU1lTLlJFUS5DTEFJTVMuTElTVCIsIiRTWVMuUkVRLkNMQUlNUy5VUERBVEUiLCIkU1lTLlJFUS5DTEFJTVMuREVMRVRFIl19LCJzdWIiOnsiYWxsb3ciOlsiX0lOQk9YLlx1MDAzZSJdfSwic3VicyI6LTEsImRhdGEiOi0xLCJwYXlsb2FkIjotMSwiaXNzdWVyX2FjY291bnQiOiJBRFZFQUk0SlhESlhDNFFJNlhHUFY2TENMQ0tLVVJDQldEVk5YTVE2UEdSWVhVU1laR1FDM0xDQSIsInR5cGUiOiJ1c2VyIiwidmVyc2lvbiI6Mn19.fPHfPlWR6qB8EgtUN52GmTg6T9OkFEJHPv16aN3v_qZ0f_or39dmRlr0HBZ2liVdlOyyDZeGvbD9Y9NNU2EYAA","sig":"mf3G7jQmsU2yb2ag9qQ-gHl9DGs3E7-F8P71j3LYDNxqey7jcPiPxXBfY0MdQYlNECjDNNK3e2tSONxJ71tiAw","tls_required":false,"name":"nsc_push","lang":"go","version":"1.46.0","protocol":1,"echo":true,"headers":false,"no_responders":false}]
[53546] 2026/02/19 15:48:53.509539 [TRC] 127.0.0.1:56862 - cid:1 - ->> [PING]
[53546] 2026/02/19 15:48:53.509552 [TRC] 127.0.0.1:56862 - cid:1 - <<- [PONG]
[53546] 2026/02/19 15:48:53.509704 [TRC] 127.0.0.1:56862 - cid:1 - ->> [SUB _INBOX.9ML9Xq7cqAXTRCImi29bDV  1]
[53546] 2026/02/19 15:48:53.509715 [TRC] 127.0.0.1:56862 - cid:1 - ->> [PUB $SYS.REQ.CLAIMS.UPDATE _INBOX.9ML9Xq7cqAXTRCImi29bDV 712]
[53546] 2026/02/19 15:48:53.509726 [TRC] 127.0.0.1:56862 - cid:1 - ->> MSG_PAYLOAD: [eyJ0eXAiOiJKV1QiLCJhbGciOiJlZDI1NTE5LW5rZXkifQ.eyJqdGkiOiJLWFEzU0EzRjZJWjNDSzdINDc2N1RIR1NMVlhOQzRMV0k3WkUyTzZLM1E1V1RQSzdTNU1BIiwiaWF0IjoxNzcxNTExODg5LCJpc3MiOiJPQjNFRU9NVTNBTkZPREVYN0VTSkFKVU02REhOTUZNUFVYWEFKUTZNU1NYTDRHR0w3UVRCNVE1ViIsIm5hbWUiOiJzZW50aW5lbCIsInN1YiI6IkFDM1VMVzVOSkZUTFBaRTVZS1pORFBPVjNWWkc2WVIzWjdXRkJCVEhTSExJUlhLSjZNTExVWDVEIiwibmF0cyI6eyJsaW1pdHMiOnsic3VicyI6LTEsImRhdGEiOi0xLCJwYXlsb2FkIjotMSwiaW1wb3J0cyI6LTEsImV4cG9ydHMiOi0xLCJ3aWxkY2FyZHMiOnRydWUsImNvbm4iOi0xLCJsZWFmIjotMX0sImRlZmF1bHRfcGVybWlzc2lvbnMiOnsicHViIjp7fSwic3ViIjp7fX0sImF1dGhvcml6YXRpb24iOnt9LCJ0eXBlIjoiYWNjb3VudCIsInZlcnNpb24iOjJ9fQ.mHYBo5NJEYPjcyed_3aKToOomFc-bD7RIWaM2v9HoIBq2P9-_Hg6fZnk5G9ZlaFH2EpDQQXiiz3LbL96gjH6Dw]
[53546] 2026/02/19 15:48:54.510106 [DBG] 127.0.0.1:56862 - cid:1 - Client connection closed

server config file, myconfig.conf:

server_name: servertest
listen: 127.0.0.1:8222
http: 9222

jetstream: enabled

include resolver.conf

And the resolver.conf file:

# Operator named tony
operator: eyJ0eXAiOiJKV1QiLCJhbGciOiJlZDI1NTE5LW5rZXkifQ.eyJqdGkiOiJQS1RDSDVXTk8zWlhHWFhJS0tFWUZYUDc2NlFUN0NFTkJFUzNOS0s0NkhITUtHUVlYT0xBIiwiaWF0IjoxNzcxNTEyMDcwLCJpc3MiOiJPQjNFRU9NVTNBTkZPREVYN0VTSkFKVU02REhOTUZNUFVYWEFKUTZNU1NYTDRHR0w3UVRCNVE1ViIsIm5hbWUiOiJ0b255Iiwic3ViIjoiT0IzRUVPTVUzQU5GT0RFWDdFU0pBSlVNNkRITk1GTVBVWFhBSlE2TVNTWEw0R0dMN1FUQjVRNVYiLCJuYXRzIjp7Im9wZXJhdG9yX3NlcnZpY2VfdXJscyI6WyJuYXRzOi8vbG9jYWxob3N0OjgyMjIiXSwic3lzdGVtX2FjY291bnQiOiJBRFZFQUk0SlhESlhDNFFJNlhHUFY2TENMQ0tLVVJDQldEVk5YTVE2UEdSWVhVU1laR1FDM0xDQSIsInR5cGUiOiJvcGVyYXRvciIsInZlcnNpb24iOjJ9fQ.9nOYTWKQutUEMH5BBu22pdyNyls7cgIFKe_IcFEO4KdtmcufElMSYqkB7VmVPl36fdmFcIB7Rr_WcuwPEsuBDQ
# System Account named SYS
system_account: ADVEAI4JXDJXC4QI6XGPV6LCLCKKURCBWDVNXMQ6PGRYXUSYZGQC3LCA

# configuration of the nats based resolver
resolver {
    type: full
    # Directory in which the account jwt will be stored
    dir: './jwt'
    # In order to support jwt deletion, set to true
    # If the resolver type is full delete will rename the jwt.
    # This is to allow manual restoration in case of inadvertent deletion.
    # To restore a jwt, remove the added suffix .delete and restart or send a reload signal.
    # To free up storage you must manually delete files with the suffix .delete.
    allow_delete: false
    # Interval at which a nats-server with a nats based account resolver will compare
    # it's state with one random nats based account resolver in the cluster and if needed, 
    # exchange jwt and converge on the same set of jwt.
    interval: "2m"
    # Timeout for lookup requests in case an account does not exist locally.
    timeout: "1.9s"
}


# Preload the nats based resolver with the system account jwt.
# This is not necessary but avoids a bootstrapping system account. 
# This only applies to the system account. Therefore other account jwt are not included here.
# To populate the resolver:
# 1) make sure that your operator has the account server URL pointing at your nats servers.
#    The url must start with: "nats://" 
#    nsc edit operator --account-jwt-server-url nats://localhost:4222
# 2) push your accounts using: nsc push --all
#    The argument to push -u is optional if your account server url is set as described.
# 3) to prune accounts use: nsc push --prune 
#    In order to enable prune you must set above allow_delete to true
# Later changes to the system account take precedence over the system account jwt listed here.
resolver_preload: {
        ADVEAI4JXDJXC4QI6XGPV6LCLCKKURCBWDVNXMQ6PGRYXUSYZGQC3LCA: eyJ0eXAiOiJKV1QiLCJhbGciOiJlZDI1NTE5LW5rZXkifQ.eyJqdGkiOiJNRFVLRFNVSlJCTDdCSUxQUE9DQkJCMjJISlFVUE0yV01VTU1ZVlhWS0RHTllSVzZCN0FRIiwiaWF0IjoxNzcxNTEyMDU4LCJpc3MiOiJPQjNFRU9NVTNBTkZPREVYN0VTSkFKVU02REhOTUZNUFVYWEFKUTZNU1NYTDRHR0w3UVRCNVE1ViIsIm5hbWUiOiJTWVMiLCJzdWIiOiJBRFZFQUk0SlhESlhDNFFJNlhHUFY2TENMQ0tLVVJDQldEVk5YTVE2UEdSWVhVU1laR1FDM0xDQSIsIm5hdHMiOnsibGltaXRzIjp7InN1YnMiOi0xLCJkYXRhIjotMSwicGF5bG9hZCI6LTEsImltcG9ydHMiOi0xLCJleHBvcnRzIjotMSwid2lsZGNhcmRzIjp0cnVlLCJjb25uIjotMSwibGVhZiI6LTF9LCJkZWZhdWx0X3Blcm1pc3Npb25zIjp7InB1YiI6e30sInN1YiI6e319LCJhdXRob3JpemF0aW9uIjp7fSwidHlwZSI6ImFjY291bnQiLCJ2ZXJzaW9uIjoyfX0.aMhYERYKnJTfbuABjyEYe-b2ZgL6f3SFd95R1fBMZKB_rioy1V1_CrW9z1vH1olG9Kl0cOD25mZF4_hWKggJAg,
}

I've been trying to get NATS to work for hours and hours -but it seems impossible.

Any pointers or ideas are much appreciated, thanks.

[MauriceVanVeen]

Followed the guide and was able to push the account. Not sure what's different between your config and mine.

Looking at your server version:

Starting nats-server version 1.4.1

That's way too old! You'll need at least 2.2.0, which is also logged when creating an operator:

[ OK ] When running your own nats-server, make sure they run at least version 2.2.0

I'd highly recommend you upgrade to the latest 2.12.4 version.

---

I'd also recommend trying out a simple local setup for local dev if you're just starting out, that's as simple as nats-server -js to get a local server that's JetStream-enabled.

---

Admittedly the UX of nsc isn't the best still, and is one of the reasons for improving it as part of the new nats auth command. That makes it a lot simpler, I've successfully used the following steps:

# Create and select operator.
nats auth operator add MyOperator
nats auth operator select MyOperator

# Create account, user, and creds.
nats auth account add MyAccount --defaults
nats auth user add MyUser MyAccount --defaults
nats auth user credential MyUser.creds MyUser MyAccount

# SYSTEM account is pre-created, create user and creds for it.
nats auth user add sys SYSTEM --defaults
nats auth user credential sys.creds sys SYSTEM

# Generate server config (prompts for storage dir, etc.)
# Select: "'nats auth' managed NATS Server configuration"
nats server generate nats-auth-config

nats-server -c nats-auth-config/server.conf

$ nats auth account push MyAccount --creds sys.creds 
Updating account MyAccount (ADUE6YPH3JI5FLIZVAYMZ2BDGG2HJGIMPMAL4QZL34P3KQ6RWTVLFGE7) on 1 server(s)

✓ Update completed on nats.example.net

Success 1 Failed 0 Expected 1

# In one terminal.
$ nats sub '>' --creds MyUser.creds
16:41:22 Subscribing on > 
[#1] Received on "hello"
nil body

# In another.
$ nats pub hello '' --creds MyUser.creds
16:41:42 Published 0 bytes to "hello"

[tbalbers]

Starting nats-server version 1.4.1

That's way too old! You'll need at least 2.2.0, which is also logged when creating an operator:

Oh dear.. How on earth did I manage that?..

Well, I've upgraded and of course it's now working. I'll look into the nats auth commands a bit more, thanks for the tips.

And thank you for helping me out, I was getting quite tired of it :)

[aricart]

The main issue is your server version a Maurice pointed out. Likely that version doesn't support $SYS.REQ.CLAIMS.UPDATE