{"record":{"id":"31c6bc7d8b03e92f","repo":"jwtk/jjwt","slug":"unable-to-create-jwk-iae-getmessage","errorCode":null,"errorMessage":"Unable to create JWK: ${iae.getMessage()}","messagePattern":"Unable to create JWK: (.+?)","errorType":"validation","errorClass":"MalformedKeyException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/AbstractJwkBuilder.java","lineNumber":158,"sourceCode":"    @Override\n    public J build() {\n\n        //should always exist as there isn't a way to set it outside the constructor:\n        Assert.stateNotNull(this.DELEGATE, \"JwkContext should always be non-null\");\n\n        K key = this.DELEGATE.getKey();\n        if (key == null && isEmpty()) {\n            String msg = \"A \" + Key.class.getName() + \" or one or more name/value pairs must be provided to create a JWK.\";\n            throw new IllegalStateException(msg);\n        }\n\n        try {\n            this.opsPolicy.validate(this.DELEGATE.get(AbstractJwk.KEY_OPS));\n            return jwkFactory.createJwk(this.DELEGATE);\n        } catch (IllegalArgumentException iae) {\n            //if we get an IAE, it means the builder state wasn't configured enough in order to create\n            String msg = \"Unable to create JWK: \" + iae.getMessage();\n            throw new MalformedKeyException(msg, iae);\n        }\n    }\n\n    static class DefaultSecretJwkBuilder extends AbstractJwkBuilder<SecretKey, SecretJwk, SecretJwkBuilder>\n            implements SecretJwkBuilder {\n        public DefaultSecretJwkBuilder(JwkContext<SecretKey> ctx) {\n            super(ctx);\n            // assign a standard algorithm if possible:\n            Key key = Assert.notNull(ctx.getKey(), \"SecretKey cannot be null.\");\n            DefaultMacAlgorithm mac = DefaultMacAlgorithm.findByKey(key);\n            if (mac != null) {\n                algorithm(mac.getId());\n            }\n        }\n    }\n}\n","sourceCodeStart":140,"sourceCodeEnd":175,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/AbstractJwkBuilder.java#L140-L175","documentation":"When build() delegates to jwkFactory.createJwk and an IllegalArgumentException escapes, the builder translates it into MalformedKeyException with an 'Unable to create JWK' message. It means the supplied JWK fields were present but invalid (missing required members for the kty, wrong formats, or failed validation).","triggerScenarios":"Building a JWK from name/value pairs where a required field for the key type is missing or malformed (e.g. RSA builder without 'n' or 'e', non-base64url values, invalid key-ops combination caught by ops validation).","commonSituations":"Manually assembling JWK JSON fields; parsing third-party JWK sets with incomplete entries; typo'd field names so a required member appears absent.","solutions":["Read iae.getMessage() from the cause to see which field/validation failed.","Ensure all RFC 7518-required members for the kty are present and valid base64url.","Use Jwks.parser().parse(json) for external JWK data so full validation runs.","Wrap build() in try-catch for MalformedKeyException when handling untrusted input."],"exampleFix":"// before\nJwk<?> jwk = Jwks.builder().put(\"kty\", \"RSA\").build();\n// after\nJwk<?> jwk = Jwks.builder().put(\"kty\", \"RSA\").put(\"n\", nB64).put(\"e\", eB64).build();","handlingStrategy":"validation","validationCode":"// ensure required members exist for kty before building\nSet<String> required = kty.equals(\"RSA\") ? Set.of(\"n\",\"e\") : Set.of(\"kty\",\"crv\",\"x\",\"y\");\nif (!jwkMap.keySet().containsAll(required)) throw new MalformedKeyException(\"missing: \" + new HashSet<>(required) );","typeGuard":null,"tryCatchPattern":"try { jwk = builder.build(); }\ncatch (MalformedKeyException e) { log.warn(\"Bad JWK from source: {}\", e.getMessage()); reject(e); }","preventionTips":["Validate external JWK fields before constructing builders.","Use Jwks.parser() for untrusted JWK JSON.","Check for typos in member names (kty, n, e, x, y, crv)."],"tags":["jwk","malformed-key","builder","jjwt"],"backgroundTag":"invalid-key-format","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}