{"record":{"id":"2bde3d371b3fc422","repo":"jwtk/jjwt","slug":"jwk-is-missing-required-kty-parameter","errorCode":null,"errorMessage":"JWK is missing required kty parameter.","messagePattern":"JWK is missing required kty parameter\\.","errorType":"validation","errorClass":"io.jsonwebtoken.security.MalformedKeyException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/JwkConverter.java","lineNumber":143,"sourceCode":"    public T applyFrom(Object o) {\n        Assert.notNull(o, \"JWK cannot be null.\");\n        if (desiredType.isInstance(o)) {\n            return desiredType.cast(o);\n        } else if (o instanceof Jwk<?>) {\n            throw unexpectedIAE((Jwk<?>) o);\n        }\n        if (!(o instanceof Map)) {\n            String msg = \"JWK must be a Map<String,?> (JSON Object). Type found: \" + o.getClass().getName() + \".\";\n            throw new IllegalArgumentException(msg);\n        }\n        final Map<?, ?> map = Collections.immutable((Map<?, ?>) o);\n\n        Parameter<String> param = AbstractJwk.KTY;\n        // mandatory for all JWKs: https://datatracker.ietf.org/doc/html/rfc7517#section-4.1\n        // no need for builder param type conversion overhead if this isn't present:\n        if (Collections.isEmpty(map) || !map.containsKey(param.getId())) {\n            String msg = \"JWK is missing required \" + param + \" parameter.\";\n            throw new MalformedKeyException(msg);\n        }\n        Object val = map.get(param.getId());\n        if (val == null) {\n            String msg = \"JWK \" + param + \" value cannot be null.\";\n            throw new MalformedKeyException(msg);\n        }\n        if (!(val instanceof String)) {\n            String msg = \"JWK \" + param + \" value must be a String. Type found: \" + val.getClass().getName();\n            throw new MalformedKeyException(msg);\n        }\n        String kty = (String) val;\n        if (!Strings.hasText(kty)) {\n            String msg = \"JWK \" + param + \" value cannot be empty.\";\n            throw new MalformedKeyException(msg);\n        }\n\n        DynamicJwkBuilder<?, ?> builder = this.supplier.get();\n        for (Map.Entry<?, ?> entry : map.entrySet()) {","sourceCodeStart":125,"sourceCodeEnd":161,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/JwkConverter.java#L125-L161","documentation":"When converting a raw JSON map into a Jwk, JwkConverter.applyFrom requires the mandatory 'kty' (key type) parameter as defined by RFC 7517 section 4.1. If the map is empty or lacks the 'kty' key, a MalformedKeyException is thrown. This is a hard requirement for all JWKs regardless of algorithm.","triggerScenarios":"Passing a JSON object/map without a 'kty' member to Jwks parsing/builder conversion APIs (e.g. io.jsonwebtoken.Jwks parsing a key that omits kty).","commonSituations":"Hand-written JWK JSON that omits kty; keys copied from sources that strip fields; wrong nested object passed (e.g. passing the JWK Set wrapper where an individual key is expected, or vice versa).","solutions":["Add the required \"kty\" field (e.g. \"EC\", \"RSA\", \"oct\", \"OKP\") to the JWK JSON object","Verify you are passing an individual JWK object, not a JWK Set or another structure","If parsing a JWKS document, ensure each element of the \"keys\" array contains \"kty\""],"exampleFix":"// before\n{\"k\":\"...\"}\n// after\n{\"kty\":\"oct\",\"k\":\"...\"}","handlingStrategy":"validation","validationCode":"if (jwkMap == null || !jwkMap.containsKey(\"kty\")) { throw new IllegalArgumentException(\"JWK JSON must contain a 'kty' field\"); }","typeGuard":"boolean hasKty(Map<String,?> m) { return m != null && m.get(\"kty\") instanceof String s && !s.isBlank(); }","tryCatchPattern":"try { Jwk<?> jwk = Jwks.parser().build().parse(json); } catch (MalformedKeyException e) { log.error(\"Invalid JWK: {}\", e.getMessage()); }","preventionTips":["Always include kty in every JWK you emit","Validate key JSON against RFC 7517 before parsing","Fetch keys from trusted, well-formed JWKS endpoints"],"tags":["jwt","jwk","validation","rfc7517"],"backgroundTag":"missing-required-argument","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}