{"record":{"id":"5a8b0752f404f392","repo":"nextauthjs/next-auth","slug":"unsupported-jwt-content-encryption-algorithm","errorCode":null,"errorMessage":"Unsupported JWT Content Encryption Algorithm","messagePattern":"Unsupported JWT Content Encryption Algorithm","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"packages/core/src/jwt.ts","lineNumber":214,"sourceCode":"    return null\n  }\n}\n\nasync function getDerivedEncryptionKey(\n  enc: string,\n  keyMaterial: Parameters<typeof hkdf>[1],\n  salt: Parameters<typeof hkdf>[2]\n) {\n  let length: number\n  switch (enc) {\n    case \"A256CBC-HS512\":\n      length = 64\n      break\n    case \"A256GCM\":\n      length = 32\n      break\n    default:\n      throw new Error(\"Unsupported JWT Content Encryption Algorithm\")\n  }\n  return await hkdf(\n    \"sha256\",\n    keyMaterial,\n    salt,\n    `Auth.js Generated Encryption Key (${salt})`,\n    length\n  )\n}\n\nexport interface DefaultJWT extends Record<string, unknown> {\n  name?: string | null\n  email?: string | null\n  picture?: string | null\n  sub?: string\n  iat?: number\n  exp?: number\n  jti?: string","sourceCodeStart":196,"sourceCodeEnd":232,"githubUrl":"https://github.com/nextauthjs/next-auth/blob/a1a16a5a7780488c7449feece410033f445d0b31/packages/core/src/jwt.ts#L196-L232","documentation":"getDerivedEncryptionKey derives the JWT encryption key from the secret via HKDF, and the key length depends on the configured JWT content-encryption algorithm (enc). If options.enc is set to an algorithm the library does not know how to handle, it throws this generic Error in packages/core/src/jwt.ts:214.","triggerScenarios":"Setting jwt: { encryption: true, alg: ..., enc: ... } in the Auth config with an enc value outside the supported list (A128CBC-HS256, A256GCM, etc. — only specific enc values map to HKDF output lengths).","commonSituations":"Copy-pasting JWT encryption config from blog posts or other libraries; typos in the enc string (e.g. 'A256GCM ' with whitespace or 'AES256GCM'); upgrading Auth.js and keeping an enc value from an older/unsupported preset.","solutions":["Use a supported enc value, e.g. enc: 'A256GCM' (or 'A128CBC-HS256') in the jwt config.","Check the exact spelling/case of the enc option in your auth config.","If you do not need custom encryption, remove the jwt.enc option and use the defaults."],"exampleFix":"// before\njwt: { encryption: true, enc: 'AES256GCM' }\n// after\njwt: { encryption: true, alg: 'dir', enc: 'A256GCM' }","handlingStrategy":"validation","validationCode":"const SUPPORTED_ENC = ['A128CBC-HS256', 'A256GCM', 'A192GCM', 'A128GCM']\nif (config.jwt?.enc && !SUPPORTED_ENC.includes(config.jwt.enc)) {\n  throw new Error(`Unsupported JWT enc: ${config.jwt.enc}`)\n}","typeGuard":null,"tryCatchPattern":"try {\n  const session = await auth()\n} catch (e) {\n  if ((e as Error).message.includes('Unsupported JWT Content Encryption Algorithm')) {\n    // reset jwt config to defaults\n  }\n}","preventionTips":["Stick to documented enc values (e.g. 'A256GCM') or omit the option entirely.","Add a config unit test that constructs Auth with your jwt options.","Copy JWT encryption presets only from the official Auth.js docs."],"tags":["jwt","encryption","config","jose"],"backgroundTag":"unsupported-jwt-algorithm","analyzedSha":"a1a16a5a7780488c7449feece410033f445d0b31","analyzedAt":"2026-08-28T21:52:38.200Z","schemaVersion":2},"datasetVersion":"2026-08-29T02:17:18.158Z"}