{"record":{"id":"10d8f9fd7b0b334e","repo":"jwtk/jjwt","slug":"unsupportedkey-key-e","errorCode":null,"errorMessage":"unsupportedKey(key, e)","messagePattern":"unsupportedKey\\(key, e\\)","errorType":"exception","errorClass":"UnsupportedKeyException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/DefaultDynamicJwkBuilder.java","lineNumber":98,"sourceCode":"    }\n\n    private static UnsupportedKeyException unsupportedKey(Key key, Exception e) {\n        String msg = \"There is no builder that supports specified key [\" + KeysBridge.toString(key) + \"].\";\n        return new UnsupportedKeyException(msg, e);\n    }\n\n    @SuppressWarnings(\"unchecked\")\n    @Override\n    public <A extends PublicKey, B extends PrivateKey> PublicJwkBuilder<A, B, ?, ?, ?, ?> key(A key) {\n        if (key instanceof RSAPublicKey) {\n            return (PublicJwkBuilder<A, B, ?, ?, ?, ?>) key((RSAPublicKey) key);\n        } else if (key instanceof ECPublicKey) {\n            return (PublicJwkBuilder<A, B, ?, ?, ?, ?>) key((ECPublicKey) key);\n        } else {\n            try {\n                return octetKey(key);\n            } catch (Exception e) {\n                throw unsupportedKey(key, e);\n            }\n        }\n    }\n\n    @SuppressWarnings(\"unchecked\")\n    @Override\n    public <A extends PublicKey, B extends PrivateKey> PrivateJwkBuilder<B, A, ?, ?, ?> key(B key) {\n        Assert.notNull(key, \"Key cannot be null.\");\n        if (key instanceof RSAPrivateKey) {\n            return (PrivateJwkBuilder<B, A, ?, ?, ?>) key((RSAPrivateKey) key);\n        } else if (key instanceof ECPrivateKey) {\n            return (PrivateJwkBuilder<B, A, ?, ?, ?>) key((ECPrivateKey) key);\n        } else {\n            try {\n                return octetKey(key);\n            } catch (Exception e) {\n                throw unsupportedKey(key, e);\n            }","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/DefaultDynamicJwkBuilder.java#L80-L116","documentation":"An UnsupportedKeyException produced by the staticJwk-style key(Key) dispatch in DefaultDynamicJwkBuilder when the supplied key is not a recognized RSA/EC public key and the fallback octetKey() (for SecretKey / AES / octet keys) also fails. The builder tried every known JWK family and could not map the key to one.","triggerScenarios":"Calling Jwts.SIG / dynamic JwkBuilder .key(someKey) with a public key that is neither RSA, EC, nor a usable SecretKey — e.g. a custom Key implementation, a DSA/EdDSA key variant unsupported by the installed providers, or a SecretKey whose encoding is unusable.","commonSituations":"Building JWKs for keys generated by third-party libraries or unusual providers; passing DSA keys; upgraded JDK where an algorithm provider disappeared; mixing jjwt versions that lack support for the key family.","solutions":["Verify the key instance is a supported type: RSAPublicKey, ECPublicKey, or SecretKey; generate keys via jjwt's Jwts.SIG.keyPairBuilder().","Register a JCA provider supporting the key type if it is a newer algorithm (e.g. Ed25519 on JDK < 15).","Inspect e.getCause() from the UnsupportedKeyException to see why octetKey failed.","Catch UnsupportedKeyException around builder calls and surface a clear configuration error."],"exampleFix":"// before\nSecretKey k = Keys.secretKeyFor(SignatureAlgorithm.HS256);\nPublicJwk jwk = Jwts.builder().key(o.getDsaPublicKey())... // unsupported\n// after\nKeyPair kp = Jwts.SIG.RS256.keyPair().build();\nPublicJwk jwk = Jwts.SIG.RS256.keyPair().build().toPublicJwk();","handlingStrategy":"type-guard","validationCode":"// only build JWKs from known-supported key types\nif (!(key instanceof RSAPublicKey || key instanceof ECPublicKey || key instanceof SecretKey))\n    throw new IllegalArgumentException(\"Unsupported key type: \" + key.getClass());","typeGuard":"boolean supported = k instanceof RSAPublicKey || k instanceof ECPublicKey || k instanceof SecretKey;","tryCatchPattern":"try {\n    return Jwts.SIG.keyBuilder().key(key).build();\n} catch (UnsupportedKeyException e) {\n    throw new CryptoConfigurationException(\"No JWK family for \" + key.getClass().getName(), e);\n}","preventionTips":["Generate keys via jjwt's Jwts.SIG.*.keyPair() builders","Avoid DSA and exotic provider keys for JWT use","Register providers (e.g. BouncyCastle) for newer algorithms","Log e.getCause() when octetKey fallback fails"],"tags":["jwt","jwk","unsupported-key","security"],"backgroundTag":"unsupported-key-type","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}