{"record":{"id":"66c1e89fdf765147","repo":"denoland/deno","slug":"err-invalid-arg-type-66c1e8","errorCode":"ERR_INVALID_ARG_TYPE","errorMessage":"The \"ikm\" argument must be of type string or an instance of SecretKeyObject, ArrayBuffer, TypedArray, DataView, or Buffer. Received ${key}","messagePattern":"The \"ikm\" argument must be of type string or an instance of SecretKeyObject, ArrayBuffer, TypedArray, DataView, or Buffer\\. Received (.+?)","errorType":"exception","errorClass":"ERR_INVALID_ARG_TYPE","httpStatus":null,"severity":"error","filePath":"ext/node/polyfills/internal/crypto/hkdf.ts","lineNumber":122,"sourceCode":"      info,\n      length,\n    };\n  },\n);\n\nfunction prepareKey(key: any) {\n  if (isKeyObject(key)) {\n    return key;\n  }\n\n  if (isAnyArrayBuffer(key)) {\n    return createSecretKey(new Uint8Array(key as unknown as ArrayBufferLike));\n  }\n\n  key = toBuf(key as string);\n\n  if (!isArrayBufferView(key)) {\n    throw new ERR_INVALID_ARG_TYPE(\n      \"ikm\",\n      [\n        \"string\",\n        \"SecretKeyObject\",\n        \"ArrayBuffer\",\n        \"TypedArray\",\n        \"DataView\",\n        \"Buffer\",\n      ],\n      key,\n    );\n  }\n\n  return createSecretKey(key);\n}\n\nfunction hkdf(\n  hash: string,","sourceCodeStart":104,"sourceCodeEnd":140,"githubUrl":"https://github.com/denoland/deno/blob/9ad36f7a2cce60488e6ec52283efb32efddaf93a/ext/node/polyfills/internal/crypto/hkdf.ts#L104-L140","documentation":"prepareKey in ext/node/polyfills/internal/crypto/hkdf.ts accepts an ikm (input keying material) that is a KeyObject, any ArrayBuffer, or something toBuf can convert to a Buffer view (strings, TypedArrays, DataViews). If none of those apply it throws ERR_INVALID_ARG_TYPE listing the accepted shapes. Everything else in hkdf (salt, info) is coerced leniently, but the key must be real key material.","triggerScenarios":"crypto.hkdfSync('sha256', 12345, salt, info, 32) (number); passing null/undefined, a plain object, or a boolean as key; passing a KeyObject-like wrapper (e.g. a JWK object or {k: '...'}) that is not an actual KeyObject.","commonSituations":"Reading a passphrase from an env var or JSON config and forgetting to convert it to string/Buffer; passing a parsed JWK where a SecretKeyObject is expected; passing a CryptoKey (WebCrypto object, not a Node KeyObject) into node:crypto hkdf.","solutions":["Convert the ikm to a Buffer or string before calling hkdf: Buffer.from(secret).","If you have a WebCrypto CryptoKey, export it first: crypto.subtle.exportKey('raw', key) then pass the ArrayBuffer.","If you hold a JWK, rebuild a KeyObject with crypto.createSecretKey(Buffer.from(jwk.k, 'base64url')) instead of passing the JWK itself.","Add a type check at your own API boundary so bad values fail with your error message."],"exampleFix":"// before\ncrypto.hkdfSync('sha256', 12345, salt, info, 32); // number ikm -> ERR_INVALID_ARG_TYPE\n\n// after\ncrypto.hkdfSync('sha256', '12345', salt, info, 32);             // string\ncrypto.hkdfSync('sha256', Buffer.from('12345'), salt, info, 32); // or Buffer","handlingStrategy":"type-guard","validationCode":"function assertIkm(key) {\n  const ok = typeof key === 'string' || Buffer.isBuffer(key) ||\n    ArrayBuffer.isView(key) || key instanceof ArrayBuffer ||\n    (key && typeof key === 'object' && key.constructor?.name === 'KeyObject');\n  if (!ok) throw new TypeError('hkdf key must be string/Buffer/TypedArray/ArrayBuffer/KeyObject');\n}\nassertIkm(ikm);\ncrypto.hkdfSync('sha256', ikm, salt, info, 32);","typeGuard":"function isHkdfKeyMaterial(v) {\n  return typeof v === 'string' || ArrayBuffer.isView(v) ||\n    v instanceof ArrayBuffer || crypto.KeyObject?.isKeyObject?.(v) === true;\n}","tryCatchPattern":"try {\n  crypto.hkdfSync('sha256', ikm, salt, info, 32);\n} catch (e) {\n  if (e.code === 'ERR_INVALID_ARG_TYPE' && /ikm/.test(e.message)) {\n    throw new TypeError(`bad ikm from source X (${typeof ikm})`);\n  }\n  throw e;\n}","preventionTips":["Coerce secrets to Buffer at the edge: ikm = Buffer.from(ikm).","Export WebCrypto CryptoKeys via subtle.exportKey before feeding node:crypto hkdf.","Type-check values coming from JSON/env before passing them as key material."],"tags":["crypto","hkdf","argument-type","key-material","node-compat"],"backgroundTag":"invalid-argument-type","analyzedSha":"9ad36f7a2cce60488e6ec52283efb32efddaf93a","analyzedAt":"2026-08-20T13:07:44.778Z","schemaVersion":2},"datasetVersion":"2026-08-21T11:28:35.574Z"}