BookStackApp/BookStack · error · OidcInvalidKeyException

Only signature keys are currently supported. Found key for u

Error message

Only signature keys are currently supported. Found key for use {$jwk['use']}

What it means

Beyond kty/alg, the JWK must be a signing key: the optional 'use' parameter, if present, must be 'sig'. Keys marked for encryption ('enc') are rejected because this class only builds signature verification keys. Absent 'use' defaults to 'sig' per OIDC discovery rules.

Source

Thrown at app/Access/Oidc/OidcJwtSigningKey.php:69

    }

    /**
     * @throws OidcInvalidKeyException
     */
    protected function loadFromJwkArray(array $jwk): void
    {
        // 'alg' is optional for a JWK, but we will still attempt to validate if
        // it exists otherwise presume it will be compatible.
        $alg = $jwk['alg'] ?? null;
        if ($jwk['kty'] !== 'RSA' || !(is_null($alg) || $alg === 'RS256')) {
            throw new OidcInvalidKeyException("Only RS256 keys are currently supported. Found key using {$alg}");
        }

        // 'use' is optional for a JWK but we assume 'sig' where no value exists since that's what
        // the OIDC discovery spec infers since 'sig' MUST be set if encryption keys come into play.
        $use = $jwk['use'] ?? 'sig';
        if ($use !== 'sig') {
            throw new OidcInvalidKeyException("Only signature keys are currently supported. Found key for use {$jwk['use']}");
        }

        if (empty($jwk['e'])) {
            throw new OidcInvalidKeyException('An "e" parameter on the provided key is expected');
        }

        if (empty($jwk['n'])) {
            throw new OidcInvalidKeyException('A "n" parameter on the provided key is expected');
        }

        $n = strtr($jwk['n'], '-_', '+/');

        try {
            $key = PublicKeyLoader::load([
                'e' => new BigInteger(base64_decode($jwk['e']), 256),
                'n' => new BigInteger(base64_decode($n), 256),
            ]);
        } catch (\Exception $exception) {

View on GitHub (pinned to 18f8469a1c)

Solutions

1. Filter the JWKS to keys with use === 'sig' (or no 'use' at all)
2. Pick the key whose kid matches the token header instead of the first key
3. If the IdP mislabels keys, correct its JWKS configuration
4. For test fixtures, set 'use' => 'sig' or remove 'use'

Example fix

// before
$jwk = $jwks['keys'][0];
// after
$jwk = current(array_filter($jwks['keys'], fn($k) => ($k['use'] ?? 'sig') === 'sig' && $k['kty'] === 'RSA'));

if (($jwk['use'] ?? 'sig') !== 'sig') { throw new \RuntimeException('JWK is not a signing key'); }

function isSigJwk(array $jwk): bool { return ($jwk['use'] ?? 'sig') === 'sig'; }

try { $key = new OidcJwtSigningKey($jwk); } catch (OidcInvalidKeyException $e) { if (str_contains($e->getMessage(), 'signature keys')) { /* pick a use=sig key */ } throw $e; }

When it happens

Trigger: new OidcJwtSigningKey($jwkArray) where $jwkArray['use'] is 'enc' (or any value other than 'sig').

Common situations: IdP publishes both signing and encryption keys in its JWKS and the code picks the encryption key; mis-copied JWK with use=enc; automated key-rotation script selecting keys without filtering on use.

Related errors

• Only RS256 keys are currently supported. Found key using {$a
• An "e" parameter on the provided key is expected
• A "n" parameter on the provided key is expected
• Failed to load key from JWK parameters with error: {$excepti
• Token audience value has ' . count($aud) . ' values, Expecte

AI-assisted analysis of BookStackApp/BookStack@18f8469a1c (2026-09-02). Data as JSON: /api/errors/746aaeb7f94ac5a3. Report an issue: GitHub.