{"record":{"id":"571b9aa97d7d96e4","repo":"mastra-ai/mastra","slug":"unsupported-jws-algorithm-for-a2a-agent-card-signi","errorCode":null,"errorMessage":"Unsupported JWS algorithm for A2A Agent Card signing: ${alg}","messagePattern":"Unsupported JWS algorithm for A2A Agent Card signing: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/server/src/server/a2a/agent-card-signing.ts","lineNumber":41,"sourceCode":"\nfunction importSigningKey(signing: A2AAgentCardSigningConfig) {\n  const { privateKey } = signing;\n\n  if (typeof privateKey === 'string') {\n    return crypto.createPrivateKey(privateKey);\n  }\n\n  return crypto.createPrivateKey({\n    key: privateKey,\n    format: 'jwk',\n  });\n}\n\nfunction getProtectedHeader(signing: A2AAgentCardSigningConfig): Record<string, unknown> {\n  const { alg, ...rest } = signing.protectedHeader;\n\n  if (!SUPPORTED_JWS_ALGORITHMS.has(alg)) {\n    throw new Error(`Unsupported JWS algorithm for A2A Agent Card signing: ${alg}`);\n  }\n\n  return {\n    ...rest,\n    alg,\n  };\n}\n\ntype SignatureOptions = Pick<crypto.SignKeyObjectInput, 'dsaEncoding' | 'padding' | 'saltLength'>;\n\nfunction getSignatureOptions(algorithm: string): SignatureOptions {\n  if (algorithm.startsWith('ES')) {\n    return { dsaEncoding: 'ieee-p1363' as const };\n  }\n\n  if (algorithm.startsWith('PS')) {\n    return {\n      padding: crypto.constants.RSA_PKCS1_PSS_PADDING,","sourceCodeStart":23,"sourceCodeEnd":59,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/packages/server/src/server/a2a/agent-card-signing.ts#L23-L59","documentation":"When signing an A2A Agent Card, getProtectedHeader() validates the JWS 'alg' from A2AAgentCardSigningConfig.protectedHeader against SUPPORTED_JWS_ALGORITHMS (ES256/384/512, RS256/384/512, PS256/384/512). Asymmetric algorithms only — HMAC (HS*) and others are rejected — so the error fires when an unsupported algorithm name is configured.","triggerScenarios":"Setting signing.protectedHeader.alg to e.g. 'HS256', 'ES256K', 'EdDSA', or any string not in the supported set when configuring A2A agent card signing.","commonSituations":"Copying a JWT config that uses HS256 with a shared secret; typo in the alg string; using an octet/Ed25519 key with EdDSA; assuming all RFC 7518 algorithms are supported.","solutions":["Change alg to a supported asymmetric algorithm: ES256/ES384/ES512, RS256/RS384/RS512, or PS256/PS384/PS512.","Replace any HMAC/shared-secret key with an EC or RSA private key matching the chosen algorithm.","Fix casing/typos — alg values are exact case-sensitive strings ('ES256', not 'es256').","For Ed25519 keys, generate an EC P-256/384/521 or RSA key instead, since EdDSA is not supported."],"exampleFix":"// before\nsigning: { privateKey, protectedHeader: { alg: 'HS256' } }\n// after\nsigning: { privateKey, protectedHeader: { alg: 'ES256' } }","handlingStrategy":"validation","validationCode":"const SUPPORTED = new Set(['ES256','ES384','ES512','RS256','RS384','RS512','PS256','PS384','PS512']);\nif (!SUPPORTED.has(signing.protectedHeader.alg)) {\n  throw new Error(`alg must be one of ${[...SUPPORTED].join(', ')}`);\n}","typeGuard":"type SupportedJwsAlg = 'ES256'|'ES384'|'ES512'|'RS256'|'RS384'|'RS512'|'PS256'|'PS384'|'PS512';\nconst isSupportedAlg = (a: string): a is SupportedJwsAlg =>\n  /^(ES|RS|PS)(256|384|512)$/.test(a);","tryCatchPattern":"try {\n  const signed = await signAgentCard({ agentCard, signing });\n} catch (e) {\n  if (e.message.includes('Unsupported JWS algorithm')) {\n    throw new ConfigError('A2A signing alg must be ES/RS/PS with 256/384/512');\n  }\n  throw e;\n}","preventionTips":["Store the alg in a typed constant union, not a free-form string.","Validate signing config at startup with the regex /^(ES|RS|PS)(256|384|512)$/.","Never reuse JWT/HMAC (HS*) configs for A2A card signing."],"tags":["jws","a2a","crypto","config"],"backgroundTag":"unsupported-jws-algorithm","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T03:17:51.788Z"}