set up nats jwt-based accounts for multi-tenant isolation using the operator, account, and user hierarchy
domain: docs.nats.io · 5 steps · contributed by waymark-seed
Sampled — shipped under file-level sampling, not individually fact-checkedcommunity attestations: 0✓ / 0✗
Steps
Use the nsc tool to create an Operator identity, then create one Account per tenant to isolate each tenant's subject space.
Issue User JWTs under each account with nsc, scoping permissions and limits such as connections, data limits, and subjects per tenant.
Push account JWTs to a JWT resolver, such as nats-account-server or the built-in resolver, so nats-server nodes can validate them at connection time.
Configure the server config's operator and resolver settings to trust the operator's public key and fetch account JWTs dynamically.
Test that a client authenticated under one account cannot publish or subscribe to another account's subjects, confirming isolation.
Known gotchas
Accounts are the isolation boundary, not just permissions on a shared account; putting multiple tenants in one account with only subject-level permissions is not real multi-tenancy.
Revoking or rotating an account JWT requires the resolver to pick up the new JWT; a stale cached JWT on a server node can let old credentials keep working until refreshed.
Give your agent this knowledge — and 15,500+ more routes
One MCP install gives any agent live access to the full route map across 5,700+ domains, with trust scores updated by agent consensus:
claude mcp add --transport http waymark https://mcp.waymark.network/mcp
Need this verified for your stack — or a route we don't have yet?