{"record":{"id":"baf1db58d7c8671e","repo":"jwtk/jjwt","slug":"missing-required-keys-parameter","errorCode":null,"errorMessage":"Missing required keys parameter.","messagePattern":"Missing required keys parameter\\.","errorType":"validation","errorClass":"io.jsonwebtoken.security.MalformedKeySetException","httpStatus":null,"severity":"error","filePath":"impl/src/main/java/io/jsonwebtoken/impl/security/JwkSetConverter.java","lineNumber":87,"sourceCode":"    }\n\n    @Override\n    public JwkSet applyFrom(Object o) {\n        Assert.notNull(o, \"Value cannot be null.\");\n        if (o instanceof JwkSet) {\n            return (JwkSet) o;\n        }\n        if (!(o instanceof Map)) {\n            String msg = \"Value must be a Map<String,?> (JSON Object). Type found: \" + o.getClass().getName() + \".\";\n            throw new IllegalArgumentException(msg);\n        }\n        final Map<?, ?> m = Collections.immutable((Map<?, ?>) o);\n\n        // mandatory for all JWK Sets: https://datatracker.ietf.org/doc/html/rfc7517#section-5\n        // no need for builder parameter type conversion overhead if this isn't present:\n        if (Collections.isEmpty(m) || !m.containsKey(PARAM.getId())) {\n            String msg = \"Missing required \" + PARAM + \" parameter.\";\n            throw new MalformedKeySetException(msg);\n        }\n        Object val = m.get(PARAM.getId());\n        if (val == null) {\n            String msg = \"JWK Set \" + PARAM + \" value cannot be null.\";\n            throw new MalformedKeySetException(msg);\n        }\n        if (!(val instanceof Collection)) {\n            String msg = \"JWK Set \" + PARAM + \" value must be a Collection (JSON Array). Type found: \" +\n                    val.getClass().getName();\n            throw new MalformedKeySetException(msg);\n        }\n        int size = Collections.size((Collection<?>) val);\n        if (size == 0) {\n            String msg = \"JWK Set \" + PARAM + \" collection cannot be empty.\";\n            throw new MalformedKeySetException(msg);\n        }\n\n        // Copy values so we don't mutate the original input","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/impl/src/main/java/io/jsonwebtoken/impl/security/JwkSetConverter.java#L69-L105","documentation":"Thrown by JwkSetConverter.applyFrom when the JWK Set JSON object lacks the mandatory keys member. RFC 7517 §5 defines keys as the one required member of a JWK Set, so its absence makes the input not a valid JWK Set and conversion fails with MalformedKeySetException.","triggerScenarios":"Parsing a JWKS document JSON object that has no \"keys\" member, e.g. {\"x5u\":\"...\"} or an empty object.","commonSituations":"IdP metadata endpoints returning objects without keys; wrong field name like \"key\" or \"jwks\" used instead of \"keys\"; cached/stripped responses.","solutions":["Add the required \"keys\" array to the JWK Set JSON","Verify the field is spelled exactly \"keys\"","Confirm you fetched the correct JWKS endpoint content"],"exampleFix":"// before\n{\"x5u\":\"https://example.com/cert\"}\n// after\n{\"keys\":[{\"kty\":\"RSA\",\"n\":\"...\",\"e\":\"AQAB\"}]}","handlingStrategy":"validation","validationCode":"if (m == null || !m.containsKey(\"keys\")) { throw new IllegalArgumentException(\"JWKS document must contain a 'keys' member\"); }","typeGuard":"boolean isWellFormedJwks(Object o) { return o instanceof Map<?,?> m && m.containsKey(\"keys\"); }","tryCatchPattern":"try { JwkSet s = Jwks.setBuilder().build(); } catch (MalformedKeySetException e) { log.error(\"JWKS missing keys: {}\", e.getMessage()); }","preventionTips":["Spell the member exactly as \"keys\"","Verify JWKS endpoint payloads with a schema/integration test"],"tags":["jwt","jwks","validation","rfc7517"],"backgroundTag":"missing-required-argument","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}