{"record":{"id":"6d9bc89aabc2a203","repo":"lcobucci/jwt","slug":"the-type-of-the-provided-key-is-not-expectedtype-actualtype","errorCode":null,"errorMessage":"The type of the provided key is not \"{expectedType}\", \"{actualType}\" provided","messagePattern":"The type of the provided key is not \"(.+?)\", \"(.+?)\" provided","errorType":"exception","errorClass":"Lcobucci\\JWT\\Signer\\InvalidKeyProvided","httpStatus":null,"severity":"error","filePath":"src/Signer/Ecdsa.php","lineNumber":39,"sourceCode":"            $this->createSignature($key, $payload),\n            $this->pointLength(),\n        );\n    }\n\n    final public function verify(string $expected, string $payload, Key $key): bool\n    {\n        return $this->verifySignature(\n            $this->converter->toAsn1($expected, $this->pointLength()),\n            $payload,\n            $key,\n        );\n    }\n\n    /** {@inheritDoc} */\n    final protected function guardAgainstIncompatibleKey(int $type, int $lengthInBits): void\n    {\n        if ($type !== OPENSSL_KEYTYPE_EC) {\n            throw InvalidKeyProvided::incompatibleKeyType(\n                self::KEY_TYPE_MAP[OPENSSL_KEYTYPE_EC],\n                self::KEY_TYPE_MAP[$type] ?? 'unknown',\n            );\n        }\n\n        $expectedKeyLength = $this->expectedKeyLength();\n\n        if ($lengthInBits !== $expectedKeyLength) {\n            throw InvalidKeyProvided::incompatibleKeyLength($expectedKeyLength, $lengthInBits);\n        }\n    }\n\n    /** {@inheritDoc} */\n    final protected function guardAgainstIncompatibleCurve(?string $curveName): void\n    {\n        $expectedCurve = $this->expectedCurve();\n\n        if ($curveName !== $expectedCurve) {","sourceCodeStart":21,"sourceCodeEnd":57,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Signer/Ecdsa.php#L21-L57","documentation":"Ecdsa's guardAgainstIncompatibleKey verifies that the OpenSSL key material given to the signer is actually an EC key (OPENSSL_KEYTYPE_EC). If openssl_pkey_get_details() reports a different key type (RSA, DSA, Ed25519, DH), the signer throws InvalidKeyProvided::incompatibleKeyType naming the expected and actual key types. Each concrete ECDSA signer requires an EC key on its expected curve.","triggerScenarios":"Constructing an ECDSA signer (e.g. Es256, Es384, Es512) and calling sign/verify with a Key built from an RSA (or other) PEM/KEY string; passing an openssl key resource whose details['type'] !== OPENSSL_KEYTYPE_EC.","commonSituations":"Swapping signing algorithms (e.g. from RS256 to ES256) without regenerating the key pair; loading the wrong PEM file from disk; a config pointing at a shared RSA certificate; automated key rotation that injects a mismatched key.","solutions":["Generate a proper EC key on the required curve, e.g. openssl ecparam -name prime256v1 -genkey -noout -out ec-private.pem (use secp384r1 for ES384, secp521r1 for ES512).","Inspect the loaded key with openssl_pkey_get_details(openssl_pkey_get_private($pem)) and confirm ['type'] === OPENSSL_KEYTYPE_EC before passing it to the signer.","Point your configuration at the correct EC key file — the current path likely contains an RSA key.","If migrating algorithms, re-sign tokens with the new EC key pair and update verifiers accordingly instead of reusing RSA keys."],"exampleFix":"// before\n$signer = new Es256();\n$key = new Key(file_get_contents('rsa-private.pem')); // RSA key -> incompatibleKeyType\n\n// after\nshell_exec('openssl ecparam -name prime256v1 -genkey -noout -out ec-private.pem');\n$key = new Key(file_get_contents('ec-private.pem')); // EC key on P-256","handlingStrategy":"validation","validationCode":"$details = openssl_pkey_get_details(openssl_pkey_get_private($pem));\nif (($details['type'] ?? null) !== OPENSSL_KEYTYPE_EC) {\n    throw new InvalidArgumentException('ECDSA signers require an EC key; got type ' . ($details['type'] ?? 'unknown'));\n}","typeGuard":"function isEcKeyString(string $pem): bool\n{\n    $key = openssl_pkey_get_private($pem);\n    if ($key === false) {\n        return false;\n    }\n    return (openssl_pkey_get_details($key)['type'] ?? null) === OPENSSL_KEYTYPE_EC;\n}","tryCatchPattern":"try {\n    $token = $config->builder()->getToken($signer, $key);\n} catch (InvalidKeyProvided $e) {\n    throw new ConfigurationException('Signing key incompatible with ECDSA signer: ' . $e->getMessage(), previous: $e);\n}","preventionTips":["Keep EC and RSA key files in clearly separated directories and name files with the algorithm (ec-p256-private.pem).","Validate key type at config load time with openssl_pkey_get_details before wiring a signer.","When changing JWT algorithms, generate a brand-new key pair on the required curve rather than reusing RSA keys.","Ensure openssl_pkey_get_private() succeeds (returns a key, not false) before using it — a failed parse can also surface as a wrong type."],"tags":["ecdsa","openssl","key-type","signing"],"backgroundTag":"invalid-key-type","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}