{"record":{"id":"135c8fc630a58ceb","repo":"jwtk/jjwt","slug":"key-argument-cannot-be-null","errorCode":null,"errorMessage":"Key argument cannot be null.","messagePattern":"Key argument cannot be null\\.","errorType":"exception","errorClass":"InvalidKeyException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java","lineNumber":573,"sourceCode":"     * recommended algorithms while the {@code PS}* variants are simply marked as optional.</li>\n     * <li>The {@link #RS256}, {@link #RS384}, and {@link #RS512} algorithms are available in the JDK by default\n     * while the {@code PS}* variants require an additional JCA Provider (like BouncyCastle).</li>\n     * </ul>\n     *\n     * <p>Finally, this method will throw an {@link InvalidKeyException} for any key that does not match the\n     * heuristics and requirements documented above, since that inevitably means the Key is either insufficient or\n     * explicitly disallowed by the JWT specification.</p>\n     *\n     * @param key the key to inspect\n     * @return the recommended signature algorithm to be used with the specified key\n     * @throws InvalidKeyException for any key that does not match the heuristics and requirements documented above,\n     *                             since that inevitably means the Key is either insufficient or explicitly disallowed by the JWT specification.\n     * @since 0.10.0\n     */\n    public static SignatureAlgorithm forSigningKey(Key key) throws InvalidKeyException {\n\n        if (key == null) {\n            throw new InvalidKeyException(\"Key argument cannot be null.\");\n        }\n\n        if (!(key instanceof SecretKey ||\n                (key instanceof PrivateKey && (key instanceof ECKey || key instanceof RSAKey)))) {\n            String msg = \"JWT standard signing algorithms require either 1) a SecretKey for HMAC-SHA algorithms or \" +\n                    \"2) a private RSAKey for RSA algorithms or 3) a private ECKey for Elliptic Curve algorithms.  \" +\n                    \"The specified key is of type \" + key.getClass().getName();\n            throw new InvalidKeyException(msg);\n        }\n\n        if (key instanceof SecretKey) {\n\n            SecretKey secretKey = (SecretKey) key;\n            byte[] encoded = EMPTY_BYTES;\n            int bitLength;\n            try {\n                encoded = secretKey.getEncoded();\n                bitLength = io.jsonwebtoken.lang.Arrays.length(encoded) * Byte.SIZE;","sourceCodeStart":555,"sourceCodeEnd":591,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java#L555-L591","documentation":"Null-guard at the top of SignatureAlgorithm.forSigningKey(Key): this static helper inspects a key to recommend a compatible signature algorithm, and a null argument provides nothing to inspect, so InvalidKeyException is thrown immediately before any instanceof or size heuristics run.","triggerScenarios":"Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:573 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Ensure the key is initialized before calling forSigningKey — check key loading/derivation code that returned null.","Guard the call site with a null check and fail with a clearer application-level error.","Load keys via Keys.* factory methods or a keystore so a non-null Key is guaranteed."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}