{"record":{"id":"330af89d1ee2f211","repo":"auth0/node-jsonwebtoken","slug":"unknown-key-type-keytype","errorCode":null,"errorMessage":"Unknown key type \"${keyType}\".","messagePattern":"Unknown key type \"(.+?)\"\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"lib/validateAsymmetricKey.js","lineNumber":25,"sourceCode":"  'rsa-pss': ['PS256', 'PS384', 'PS512']\n};\n\nconst allowedCurves = {\n  ES256: 'prime256v1',\n  ES384: 'secp384r1',\n  ES512: 'secp521r1',\n};\n\nmodule.exports = function(algorithm, key) {\n  if (!algorithm || !key) return;\n\n  const keyType = key.asymmetricKeyType;\n  if (!keyType) return;\n\n  const allowedAlgorithms = allowedAlgorithmsForKeys[keyType];\n\n  if (!allowedAlgorithms) {\n    throw new Error(`Unknown key type \"${keyType}\".`);\n  }\n\n  if (!allowedAlgorithms.includes(algorithm)) {\n    throw new Error(`\"alg\" parameter for \"${keyType}\" key type must be one of: ${allowedAlgorithms.join(', ')}.`)\n  }\n\n  /*\n   * Ignore the next block from test coverage because it gets executed\n   * conditionally depending on the Node version. Not ignoring it would\n   * prevent us from reaching the target % of coverage for versions of\n   * Node under 15.7.0.\n   */\n  /* istanbul ignore next */\n  if (ASYMMETRIC_KEY_DETAILS_SUPPORTED) {\n    switch (keyType) {\n    case 'ec':\n      const keyCurve = key.asymmetricKeyDetails.namedCurve;\n      const allowedCurve = allowedCurves[algorithm];","sourceCodeStart":7,"sourceCodeEnd":43,"githubUrl":"https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/lib/validateAsymmetricKey.js#L7-L43","documentation":"jsonwebtoken validates that the asymmetric key's type (from Node's key.asymmetricKeyType) is one it knows and supports for JWT signing/verification. If the key object has an asymmetric key type that is not in the library's allowedAlgorithmsForKeys map, it throws this error because it cannot determine which 'alg' values are safe for that key.","triggerScenarios":"jwt.sign() or jwt.verify() is called with a KeyObject whose asymmetricKeyType is an unsupported type (e.g. 'ed25519', 'x25519', 'dh', 'dsa' on Node versions without support), passed as secretOrPrivateKey/secretOrPublicKey.","commonSituations":"Generating modern Ed25519/X25519 keys with crypto.generateKeyPair and passing them to an older jsonwebtoken version that only maps RSA/EC/PKCS types; passing a DH or generic key object; upgrading Node to a version that surfaces new key types the library version predates.","solutions":["Upgrade jsonwebtoken to the latest version, which supports EdDSA and more key types","Use an RSA ('RS256') or EC ('ES256') key instead of the unsupported key type","If using Ed25519/EdDSA, verify your jsonwebtoken version is >= 8.5 and Node >= 12","Pass a PEM/secret string instead of a KeyObject if the key type is genuinely unsupported"],"exampleFix":"// before\nconst { privateKey } = crypto.generateKeyPairSync('ed25519');\njwt.sign(payload, privateKey, { algorithm: 'EdDSA' }); // old lib: Unknown key type \"ed25519\"\n// after\nnpm install jsonwebtoken@latest\njwt.sign(payload, privateKey, { algorithm: 'EdDSA' });","handlingStrategy":"validation","validationCode":"const { createPublicKey } = require('crypto');\nfunction isSupportedAsymmetricKey(key) {\n  if (typeof key === 'string' || Buffer.isBuffer(key)) return true;\n  const t = key.asymmetricKeyType;\n  return ['rsa', 'rsa-pss', 'ec', 'ed25519'].includes(String(t));\n}\nif (!isSupportedAsymmetricKey(key)) throw new Error('Unsupported key type: ' + (key.asymmetricKeyType || 'secret/none'));","typeGuard":"function isKeyObjectWithSupportedType(k) {\n  return typeof k === 'object' && k !== null && 'asymmetricKeyType' in k &&\n    ['rsa', 'rsa-pss', 'ec', 'ed25519'].includes(String(k.asymmetricKeyType));\n}","tryCatchPattern":"try {\n  token = jwt.sign(payload, key, opts);\n} catch (err) {\n  if (/Unknown key type/.test(err.message)) {\n    throw new Error('Key type ' + key.asymmetricKeyType + ' unsupported by this jsonwebtoken version; upgrade the lib or use RSA/EC');\n  }\n  throw err;\n}","preventionTips":["Pin and regularly update jsonwebtoken to support modern key types","Only generate keys of type rsa, rsa-pss, ec, or ed25519 (with matching lib version) for JWTs","Check key.asymmetricKeyType during key provisioning/CI, not at sign time","Keep Node and jsonwebtoken versions aligned in your lockfile"],"tags":["jwt","asymmetric-key","key-type","node-crypto"],"backgroundTag":"jwt-unknown-key-type","analyzedSha":"b924272f29192e12926b5414546f7c5bfcc9579d","analyzedAt":"2026-09-02T21:29:06.876Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}