PrefectHQ/fastmcp · error · ValueError

Key ID '{kid}' found in JWKS but its key type is unsupported

Error message

Key ID '{kid}' found in JWKS but its key type is unsupported

What it means

The token's kid was matched against the JWKS and the key exists, but the library only supports certain key types (kty values, e.g. RSA/EC). A key with an unsupported kty — such as OKP or an exotic type — was skipped during lookup, so no usable verification key was found. This indicates a mismatch between your identity provider's key configuration and the algorithms this verifier supports.

Source

Thrown at fastmcp_slim/fastmcp/server/auth/providers/jwt.py:414

                if key_kid:
                    self._jwks_cache[key_kid] = public_key
                else:
                    # Key without kid - use a default identifier
                    self._jwks_cache["_default"] = public_key

            self._jwks_cache_time = current_time

            # Select the appropriate key
            if kid:
                if kid not in self._jwks_cache:
                    if kid in skipped_kids:
                        self.logger.debug(
                            "JWKS key lookup failed: key ID '%s' is present "
                            "but its key type is unsupported",
                            kid,
                        )
                        raise ValueError(
                            f"Key ID '{kid}' found in JWKS but its key type "
                            "is unsupported"
                        )
                    self.logger.debug(
                        "JWKS key lookup failed: key ID '%s' not found", kid
                    )
                    raise ValueError(f"Key ID '{kid}' not found in JWKS")
                return self._jwks_cache[kid]
            else:
                # No kid in token - only allow if there's exactly one key
                if len(self._jwks_cache) == 1:
                    return next(iter(self._jwks_cache.values()))
                elif len(self._jwks_cache) > 1:
                    raise ValueError(
                        "Multiple keys in JWKS but no key ID (kid) in token"
                    )
                else:
                    raise ValueError("No keys found in JWKS")

View on GitHub (pinned to 1f02114297)

Solutions

1. Inspect your JWKS (curl the jwks_uri) and check the kty field of the key with the matching kid
2. Configure your identity provider to sign tokens with a supported key type/algorithm (e.g. RS256 with an RSA key)
3. If the IdP must use the unsupported key type, use a verifier/algorithm configuration that supports it or pre-convert the key
4. Pin the token algorithm explicitly in the verifier config so the intended supported key is selected

Example fix

// before (IdP signs with EdDSA/OKP, verifier expects RSA)
// after: force IdP signing algorithm to RS256 with an RSA key, then
tokens = idp.issue(signing_alg="RS256", signing_key=rsa_key)

import httpx, jwt
jwks = httpx.get(jwks_uri).json()
header = jwt.get_unverified_header(token)
entry = next((k for k in jwks["keys"] if k.get("kid") == header.get("kid")), None)
if entry and entry.get("kty") not in ("RSA", "EC"):
    raise RuntimeError(f"JWKS key {entry['kid']} has unsupported kty={entry['kty']}")

def is_supported_key(entry: dict) -> bool:
    return entry.get("kty") in ("RSA", "EC")

try:
    claims = await verifier.verify_token(token)
except ValueError as e:
    if "key type is unsupported" in str(e):
        # IdP key type not supported: reconfigure IdP or verifier algorithms
        raise RuntimeError("IdP signing key type unsupported by verifier") from e
    raise

When it happens

Trigger: Calling verify_token on a JWT whose kid matches a JWKS entry whose kty (or algorithm) is outside the supported set, causing _get_jwks_key to raise after skipping that kid.

Common situations: Identity provider rotates to a new key type (e.g. EdDSA/OKP keys) while the verifier only accepts RSA/EC; misconfigured IdP publishes a signing key of an unexpected type; upgrading the IdP defaults without checking the JWKS contents.

Related errors

• JWKS URI not configured
• Key ID '{kid}' not found in JWKS
• Multiple keys in JWKS but no key ID (kid) in token
• No keys found in JWKS
• Failed to extract key ID from token: {e}

AI-assisted analysis of PrefectHQ/fastmcp@1f02114297 (2026-08-29). Data as JSON: /api/errors/5287f19e9f549513. Report an issue: GitHub.