{"record":{"id":"3d7df2a63a61dca8","repo":"ory/hydra","slug":"unsupported-private-key-type-t","errorCode":null,"errorMessage":"unsupported private key type: %T","messagePattern":"unsupported private key type: %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"fosite/token/jwt/jwt.go","lineNumber":78,"sourceCode":"\t\tcase *rsa.PrivateKey:\n\t\t\talg := jose.RS256\n\t\t\tif len(t.Algs()) > 0 {\n\t\t\t\talg = t.Algs()[0]\n\t\t\t}\n\n\t\t\treturn generateToken(claims, header, alg, t)\n\t\tcase *ecdsa.PrivateKey:\n\t\t\talg := jose.ES256\n\t\t\tif len(t.Algs()) > 0 {\n\t\t\t\talg = t.Algs()[0]\n\t\t\t}\n\n\t\t\treturn generateToken(claims, header, alg, t)\n\t\tdefault:\n\t\t\treturn \"\", \"\", errors.Errorf(\"unsupported private / public key pairs: %T, %T\", t, tt)\n\t\t}\n\tdefault:\n\t\treturn \"\", \"\", errors.Errorf(\"unsupported private key type: %T\", t)\n\t}\n}\n\n// Validate validates a token and returns its signature or an error if the token is not valid.\nfunc (j *DefaultSigner) Validate(ctx context.Context, token string) (string, error) {\n\tkey, err := j.GetPrivateKey(ctx)\n\tif err != nil {\n\t\treturn \"\", err\n\t}\n\n\tif t, ok := key.(*jose.JSONWebKey); ok {\n\t\tkey = t.Key\n\t}\n\n\tswitch t := key.(type) {\n\tcase *rsa.PrivateKey:\n\t\treturn validateToken(token, t.PublicKey)\n\tcase *ecdsa.PrivateKey:","sourceCodeStart":60,"sourceCodeEnd":96,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/fosite/token/jwt/jwt.go#L60-L96","documentation":"jwt.DefaultSigner.Generate reached the outermost 'default' branch of its key type switch: the private key returned by GetPrivateKey is none of the recognized shapes (ECDSA/RSA/ed25519 key, JSONWebKey, or KeyPair). This is the top-level 'unsupported private key type' variant, distinct from the key-pair variant.","triggerScenarios":"Calling Generate when GetPrivateKey(ctx) yields something entirely unexpected — e.g. a []byte, pem string, *jose.JSONWebKey whose Key itself is an interface{} the inner switch also rejected, or nil/mis-typed custom signer key.","commonSituations":"Custom GetPrivateKey implementations returning raw key material instead of parsed Go key types; configuration loading a JWK file where the key type field maps to an unhandled algorithm (e.g. oct keys used with asymmetric signing); refactors that changed the key type passed to NewSigner.","solutions":["Return a concrete supported key type (*rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey, or *jose.JSONWebKey wrapping one) from GetPrivateKey","For symmetric needs, use HMAC signing instead of the JWT RS/ES/Ed signers (oct keys are not valid here)","Parse keys with x509/jose before handing them to the signer and add a %T assertion/log","Check that the configured JWK set actually contains signing (asymmetric) keys, not encryption keys"],"exampleFix":"// before\nfunc (s *Store) GetPrivateKey(ctx) (interface{}, error) { return s.rawPEM, nil }\n// after\nfunc (s *Store) GetPrivateKey(ctx) (interface{}, error) {\n    block, _ := pem.Decode(s.rawPEM)\n    return x509.ParseECPrivateKey(block.Bytes)\n}","handlingStrategy":"type-guard","validationCode":"key, err := store.GetPrivateKey(ctx)\nif err != nil { return err }\nswitch key.(type) {\ncase *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey, *jose.JSONWebKey:\n    // ok\ndefault:\n    return fmt.Errorf(\"GetPrivateKey returned unsupported type %T\", key)\n}","typeGuard":"func isJWTPrivateKey(key interface{}) bool {\n    switch key.(type) {\n    case *rsa.PrivateKey, *ecdsa.PrivateKey, ed25519.PrivateKey, *jose.JSONWebKey:\n        return true\n    }\n    return false\n}","tryCatchPattern":"token, sig, err := signer.Generate(ctx, claims, header)\nif err != nil && strings.Contains(err.Error(), \"unsupported private key type\") {\n    log.Fatalf(\"configured key %T cannot sign JWTs\", key)\n}","preventionTips":["Never return raw bytes/PEM strings from GetPrivateKey; return parsed key types","Verify JWKS entries are asymmetric signing keys (not oct/encryption keys) before use","Add a smoke test that signs a token at service startup","Pin key algorithm (RS256/ES256/EdDSA) and load matching key types"],"tags":["jwt","fosite","signing-keys","unsupported-key-type"],"backgroundTag":"unsupported-jwt-signing-key","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}