{"record":{"id":"546acdc8ea615fdb","repo":"jwtk/jjwt","slug":"jwt-standard-signing-algorithms-require-either-1","errorCode":null,"errorMessage":"JWT standard signing algorithms require either 1) a SecretKey for HMAC-SHA algorithms or 2) a private RSAKey for RSA algorithms or 3) a private ECKey for Elliptic Curve algorithms.  The specified key is of type ${keyClassName}","messagePattern":"JWT standard signing algorithms require either 1\\) a SecretKey for HMAC-SHA algorithms or 2\\) a private RSAKey for RSA algorithms or 3\\) a private ECKey for Elliptic Curve algorithms\\.  The specified key is of type (.+?)","errorType":"exception","errorClass":"InvalidKeyException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java","lineNumber":581,"sourceCode":"     *\n     * @param key the key to inspect\n     * @return the recommended signature algorithm to be used with the specified key\n     * @throws InvalidKeyException for any key that does not match the heuristics and requirements documented above,\n     *                             since that inevitably means the Key is either insufficient or explicitly disallowed by the JWT specification.\n     * @since 0.10.0\n     */\n    public static SignatureAlgorithm forSigningKey(Key key) throws InvalidKeyException {\n\n        if (key == null) {\n            throw new InvalidKeyException(\"Key argument cannot be null.\");\n        }\n\n        if (!(key instanceof SecretKey ||\n                (key instanceof PrivateKey && (key instanceof ECKey || key instanceof RSAKey)))) {\n            String msg = \"JWT standard signing algorithms require either 1) a SecretKey for HMAC-SHA algorithms or \" +\n                    \"2) a private RSAKey for RSA algorithms or 3) a private ECKey for Elliptic Curve algorithms.  \" +\n                    \"The specified key is of type \" + key.getClass().getName();\n            throw new InvalidKeyException(msg);\n        }\n\n        if (key instanceof SecretKey) {\n\n            SecretKey secretKey = (SecretKey) key;\n            byte[] encoded = EMPTY_BYTES;\n            int bitLength;\n            try {\n                encoded = secretKey.getEncoded();\n                bitLength = io.jsonwebtoken.lang.Arrays.length(encoded) * Byte.SIZE;\n            } finally {\n                Arrays.fill(encoded, (byte) 0);\n            }\n\n            for (SignatureAlgorithm alg : PREFERRED_HMAC_ALGS) {\n                // ensure compatibility check is based on key length. See https://github.com/jwtk/jjwt/issues/381\n                if (bitLength >= alg.minKeyLength) {\n                    return alg;","sourceCodeStart":563,"sourceCodeEnd":599,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java#L563-L599","documentation":"Error \"JWT standard signing algorithms require either 1) a SecretKey for HMAC-SHA algorithms or 2) a private RSAKey for RSA algorithms or 3) a private ECKey for Elliptic Curve algorithms.  The specified key is of type ${keyClassName}\" thrown in jwtk/jjwt.","triggerScenarios":"Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:581 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Supply a key of one of the supported types: SecretKey for HMAC (HS*), RSAKey PrivateKey for RSA (RS*/PS*), or ECKey PrivateKey for EC (ES*).","Wrap raw secret bytes in a SecretKeySpec with an HmacSHA* algorithm name so the type matches family 1.","Use Keys.secretKeyFor / Keys.keyPairFor to generate keys guaranteed to match the expected type hierarchy."],"exampleFix":null,"handlingStrategy":"type-guard","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}