{"record":{"id":"cdb01c9c915cfec9","repo":"auth0/node-jsonwebtoken","slug":"key-is-not-allowed-in-parametername","errorCode":null,"errorMessage":"\"${key}\" is not allowed in \"${parameterName}\"","messagePattern":"\"(.+?)\" is not allowed in \"(.+?)\"","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"sign.js","lineNumber":51,"sourceCode":"  allowInvalidAsymmetricKeyTypes: { isValid: isBoolean, message: '\"allowInvalidAsymmetricKeyTypes\" must be a boolean'}\n};\n\nconst registered_claims_schema = {\n  iat: { isValid: isNumber, message: '\"iat\" should be a number of seconds' },\n  exp: { isValid: isNumber, message: '\"exp\" should be a number of seconds' },\n  nbf: { isValid: isNumber, message: '\"nbf\" should be a number of seconds' }\n};\n\nfunction validate(schema, allowUnknown, object, parameterName) {\n  if (!isPlainObject(object)) {\n    throw new Error('Expected \"' + parameterName + '\" to be a plain object.');\n  }\n  Object.keys(object)\n    .forEach(function(key) {\n      const validator = schema[key];\n      if (!validator) {\n        if (!allowUnknown) {\n          throw new Error('\"' + key + '\" is not allowed in \"' + parameterName + '\"');\n        }\n        return;\n      }\n      if (!validator.isValid(object[key])) {\n        throw new Error(validator.message);\n      }\n    });\n}\n\nfunction validateOptions(options) {\n  return validate(sign_options_schema, false, options, 'options');\n}\n\nfunction validatePayload(payload) {\n  return validate(registered_claims_schema, true, payload, 'payload');\n}\n\nconst options_to_payload = {","sourceCodeStart":33,"sourceCodeEnd":69,"githubUrl":"https://github.com/auth0/node-jsonwebtoken/blob/b924272f29192e12926b5414546f7c5bfcc9579d/sign.js#L33-L69","documentation":"When signing, unknown keys are rejected by default in both the options and the payload claims. Any property not present in the library's schema (options) or expected claim validators (payload) triggers this error unless allowUnknown is enabled, protecting against typos in option names and unintended claims.","triggerScenarios":"jwt.sign(payload, secret, { expireIn: '1h' }) (typo for expiresIn); passing extra options like { headers: {...} } at the wrong nesting level; including a claim in the payload object that collides with an unknown-key rule when payload validation runs with allowUnknown false.","commonSituations":"Typos in option names (expiresIn, notAfter, subjectcase); migrating from another JWT library with different option names (e.g. 'expires' instead of 'expiresIn'); bulk-passing a config object as options containing unrelated keys.","solutions":["Fix the option/claim spelling to one the library knows (expiresIn, notBefore, audience, issuer, subject, jwtid, keyid, header, etc.)","Remove unrelated keys from the options object — only jwt.sign options belong there","Move custom claims into a dedicated claims object within the payload as intended","If a key is intentional, restructure so it goes through the documented API (e.g. header via the header option)"],"exampleFix":"// before\njwt.sign(payload, secret, { expireIn: '1h' });\n// after\njwt.sign(payload, secret, { expiresIn: '1h' });","handlingStrategy":"validation","validationCode":"const SIGN_OPTIONS = ['algorithm','expiresIn','notBefore','audience','issuer','subject','jwtid','keyid','header','noTimestamp','allowInsecureKeySizes','mutatePayload','allowInvalidAsymmetricKeyTypes','encoding','clockTimestamp'];\nfunction assertKnownOptions(opts) {\n  for (const k of Object.keys(opts || {})) {\n    if (!SIGN_OPTIONS.includes(k)) throw new Error('Unknown sign option: ' + k + ' (typo?)');\n  }\n}\nassertKnownOptions(options);","typeGuard":"function hasOnlyKnownKeys(obj, known) {\n  return Object.keys(obj || {}).every(k => known.includes(k));\n}","tryCatchPattern":"try {\n  return jwt.sign(payload, secret, options);\n} catch (err) {\n  if (/is not allowed in/.test(err.message)) {\n    const bad = err.message.match(/\"([^\"]+)\" is not allowed/)[1];\n    console.warn('Dropping unknown option/claim:', bad);\n    const { [bad]: _, ...rest } = options;\n    return jwt.sign(payload, secret, rest);\n  }\n  throw err;\n}","preventionTips":["Keep an allowlist of jwt.sign option names in a shared constant and lint against it","Double-check spelling: expiresIn (not expireIn/expiry), notBefore, jwtid","Never pass whole config objects as options; pick only sign options","Write a unit test per options object your app constructs"],"tags":["jwt","option-typo","schema-validation"],"backgroundTag":"jwt-unknown-option-key","analyzedSha":"b924272f29192e12926b5414546f7c5bfcc9579d","analyzedAt":"2026-09-02T21:29:06.876Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-10T02:17:09.455Z"}