{"record":{"id":"071903c1640f5c8b","repo":"lcobucci/jwt","slug":"the-type-of-the-provided-key-is-not-expectedtype-actualtype-071903","errorCode":null,"errorMessage":"The type of the provided key is not \"{expectedType}\", \"{actualType}\" provided","messagePattern":"The type of the provided key is not \"(.+?)\", \"(.+?)\" provided","errorType":"exception","errorClass":"Lcobucci\\JWT\\Signer\\InvalidKeyProvided","httpStatus":null,"severity":"error","filePath":"src/Signer/Rsa.php","lineNumber":25,"sourceCode":"\nabstract readonly class Rsa extends OpenSSL\n{\n    private const int MINIMUM_KEY_LENGTH = 2048;\n\n    final public function sign(string $payload, Key $key): string\n    {\n        return $this->createSignature($key, $payload);\n    }\n\n    final public function verify(string $expected, string $payload, Key $key): bool\n    {\n        return $this->verifySignature($expected, $payload, $key);\n    }\n\n    final protected function guardAgainstIncompatibleKey(int $type, int $lengthInBits): void\n    {\n        if ($type !== OPENSSL_KEYTYPE_RSA) {\n            throw InvalidKeyProvided::incompatibleKeyType(\n                self::KEY_TYPE_MAP[OPENSSL_KEYTYPE_RSA],\n                self::KEY_TYPE_MAP[$type] ?? 'unknown',\n            );\n        }\n\n        if ($lengthInBits < self::MINIMUM_KEY_LENGTH) {\n            throw InvalidKeyProvided::tooShort(self::MINIMUM_KEY_LENGTH, $lengthInBits);\n        }\n    }\n}\n","sourceCodeStart":7,"sourceCodeEnd":36,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Signer/Rsa.php#L7-L36","documentation":"Thrown by Rsa::guardAgainstIncompatibleKey when the parsed OpenSSL key's type is not OPENSSL_KEYTYPE_RSA. The RSA signer only accepts RSA keys; presenting an EC, DSA, DH, or unknown key type is rejected with the expected and actual type names.","triggerScenarios":"Using an EC (or DSA) private/public key with the RS256/RS384/RS512 RSA signer — typically by passing the wrong file path or an EC-generated key to RsaSha256::create().","commonSituations":"Config confusion after migrating from ECDSA (ES256) to RSA (RS256) or vice versa, wrong key file mounted in the secret volume, generating keys with `openssl ecparam` instead of `openssl genrsa`.","solutions":["Generate an RSA key: `openssl genrsa -out private.pem 2048` and extract `openssl rsa -in private.pem -pubout -out public.pem`","Use the matching signer for your key type (Ecdsa signers for EC keys, Rsa signers for RSA keys)","Check the mounted key file is the RSA key, not an EC key from a previous setup","Confirm with `openssl pkey -in key.pem -text -noout | head` that the key type is RSA"],"exampleFix":"// before\n$key = InMemory::file('/path/ec-private.pem'); // EC key\n$signer = RsaSha256::create();\n// after\n$key = InMemory::file('/path/rsa-private.pem');\n$signer = RsaSha256::create();","handlingStrategy":"validation","validationCode":"$details = openssl_pkey_get_details(openssl_pkey_get_private(file_get_contents($pem))); if ($details['type'] !== OPENSSL_KEYTYPE_RSA) { throw new RuntimeException('Expected RSA key'); }","typeGuard":null,"tryCatchPattern":"try { $signature = $signer->sign($payload, $key); } catch (\\Jose\\Component\\Signature\\Exception\\InvalidKeyProvided $e) { /* mismatch between signer algorithm family and key type */ }","preventionTips":["Pair signer class to key type: ES256 with EC keys, RS256 with RSA keys","Name key files by type/algorithm (rsa-private.pem vs ec-private.pem)","Audit secret volumes after algorithm migrations"],"tags":["rsa","openssl","key-type","jwt"],"backgroundTag":"incompatible-source-type","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}