{"record":{"id":"4694d75bce61895c","repo":"jwtk/jjwt","slug":"jwk-set-keys-i-e-getmessage","errorCode":null,"errorMessage":"JWK Set keys[${i}]: ${e.getMessage()}","messagePattern":"JWK Set keys\\[(.+?)\\]: (.+?)","errorType":"exception","errorClass":"UnsupportedKeyException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/JwkSetConverter.java","lineNumber":127,"sourceCode":"            if (!(key instanceof String)) {\n                String msg = \"JWK Set map keys must be Strings. Encountered key '\" + key + \"' of type \" +\n                        key.getClass().getName();\n                throw new IllegalArgumentException(msg);\n            }\n            String skey = (String) key;\n            src.put(skey, entry.getValue());\n        }\n\n        Set<Jwk<?>> jwks = new LinkedHashSet<>(size);\n        int i = 0; // keep track of which element fails (if any)\n        for (Object candidate : ((Collection<?>) val)) {\n            try {\n                Jwk<?> jwk = JWK_CONVERTER.applyFrom(candidate);\n                jwks.add(jwk);\n            } catch (UnsupportedKeyException e) {\n                if (!ignoreUnsupported) {\n                    String msg = \"JWK Set keys[\" + i + \"]: \" + e.getMessage();\n                    throw new UnsupportedKeyException(msg, e);\n                }\n            } catch (IllegalArgumentException | KeyException e) {\n                if (!ignoreUnsupported) {\n                    String msg = \"JWK Set keys[\" + i + \"]: \" + e.getMessage();\n                    throw new MalformedKeySetException(msg, e);\n                }\n            }\n            i++;\n        }\n\n        // Replace the `keys` value with validated entries:\n        src.remove(PARAM.getId());\n        src.put(PARAM.getId(), jwks);\n        return new DefaultJwkSet(PARAM, src);\n    }\n}\n","sourceCodeStart":109,"sourceCodeEnd":144,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/JwkSetConverter.java#L109-L144","documentation":"When parsing a JWK Set, each candidate key entry is converted with JWK_CONVERTER.applyFrom. If conversion raises UnsupportedKeyException (an unsupported key type/algorithm) and ignoreUnsupported is false, this error wraps the original message with the entry index, e.g. \"JWK Set keys[2]: ...\". It lets callers know exactly which key in the set was unsupported.","triggerScenarios":"Parsing/converting a JWK Set whose keys array contains an entry with an unsupported \"kty\" or algorithm, with ignoreUnsupported=false (default strict mode).","commonSituations":"JWK Set published by an identity provider includes key types this jjwt version does not support (e.g. oct-pair, AKP, unusual EC curves, or keys requiring a newer jjwt release); strict parsing of an OP's JWKS endpoint that mixes supported and unsupported keys.","solutions":["Upgrade jjwt to the latest version so more key types/algorithms are supported.","Parse with ignoreUnsupported=true (e.g. via JwkSet parsing options) to skip unsupported keys instead of failing.","Filter the JWKS response to only supported \"kty\" values before conversion.","Check the wrapped message for keys[N] index to inspect and remove/replace the offending entry."],"exampleFix":"// before\nJwkSet jwks = Jwks.set().add(rawMap).build(); // strict: throws on unsupported kty\n\n// after\nJwkSet jwks = Jwks.set().add(rawMap).ignoreUnsupported(true).build(); // skips unsupported keys","handlingStrategy":"try-catch","validationCode":"Set<String> supported = Set.of(\"EC\", \"RSA\", \"oct\", \"OKP\");\nboolean allSupported(List<Map<String, Object>> keys) {\n    return keys.stream().allMatch(k -> supported.contains(k.get(\"kty\")));\n}","typeGuard":null,"tryCatchPattern":"try {\n    jwkSet = parse(json);\n} catch (UnsupportedKeyException e) {\n    // optionally re-parse with ignoreUnsupported(true) or upgrade jjwt\n    logger.warn(\"Skipping unsupported JWK: {}\", e.getMessage());\n}","preventionTips":["Pin the latest jjwt version so new key types are supported.","Check your IdP's JWKS for exotic kty values before strict parsing.","Prefer ignoreUnsupported=true for verifying-only JWKS consumption."],"tags":["jwk","jwks","unsupported-key","jsonwebtoken"],"backgroundTag":"unsupported-operation","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}