{"record":{"id":"d64f742a3f403b04","repo":"jwtk/jjwt","slug":"the-algorithm-does-not-support-shared-secret-keys","errorCode":null,"errorMessage":"The  algorithm does not support shared secret keys.","messagePattern":"The  algorithm does not support shared secret keys\\.","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"api/src/main/java/io/jsonwebtoken/security/Keys.java","lineNumber":145,"sourceCode":"     * <td>512 bits (64 bytes)</td>\n     * </tr>\n     * </table>\n     *\n     * @param alg the {@code SignatureAlgorithm} to inspect to determine which key length to use.\n     * @return a new {@link SecretKey} instance suitable for use with the specified {@link SignatureAlgorithm}.\n     * @throws IllegalArgumentException for any input value other than {@link io.jsonwebtoken.SignatureAlgorithm#HS256},\n     *                                  {@link io.jsonwebtoken.SignatureAlgorithm#HS384}, or {@link io.jsonwebtoken.SignatureAlgorithm#HS512}\n     * @deprecated since 0.12.0.  Use your preferred {@link MacAlgorithm} instance's\n     * {@link MacAlgorithm#key() key()} builder method directly.\n     */\n    @SuppressWarnings(\"DeprecatedIsStillUsed\")\n    @Deprecated\n    public static SecretKey secretKeyFor(io.jsonwebtoken.SignatureAlgorithm alg) throws IllegalArgumentException {\n        Assert.notNull(alg, \"SignatureAlgorithm cannot be null.\");\n        SecureDigestAlgorithm<?, ?> salg = Jwts.SIG.get().get(alg.name());\n        if (!(salg instanceof MacAlgorithm)) {\n            String msg = \"The \" + alg.name() + \" algorithm does not support shared secret keys.\";\n            throw new IllegalArgumentException(msg);\n        }\n        return ((MacAlgorithm) salg).key().build();\n    }\n\n    /**\n     * <p><b>Deprecation Notice</b></p>\n     *\n     * <p>As of JJWT 0.12.0, asymmetric key algorithm instances can generate KeyPairs of suitable strength\n     * for that specific algorithm by calling their {@code keyPair()} builder method directly. For example:</p>\n     *\n     * <blockquote><pre>\n     * Jwts.SIG.{@link Jwts.SIG#RS256 RS256}.keyPair().build();\n     * Jwts.SIG.{@link Jwts.SIG#RS384 RS384}.keyPair().build();\n     * Jwts.SIG.{@link Jwts.SIG#RS512 RS512}.keyPair().build();\n     * ... etc ...\n     * Jwts.SIG.{@link Jwts.SIG#ES512 ES512}.keyPair().build();</pre></blockquote>\n     *\n     * <p>Call those methods as needed instead of this static {@code keyPairFor} helper method - the returned","sourceCodeStart":127,"sourceCodeEnd":163,"githubUrl":"https://github.com/jwtk/jjwt/blob/fb71496164c71442d08adec4571d9616ed5e1b8d/api/src/main/java/io/jsonwebtoken/security/Keys.java#L127-L163","documentation":"Deprecated Keys.secretKeyFor(SignatureAlgorithm) throws IllegalArgumentException when the given algorithm is not a MAC (shared-secret) algorithm, i.e. an asymmetric algorithm like RS256/ES256 was requested as a secret key.","triggerScenarios":"Calling Keys.secretKeyFor(SignatureAlgorithm.RS256) (or ES256, PS256, EdDSA) — any non-HMAC SignatureAlgorithm whose resolved SecureDigestAlgorithm is not a MacAlgorithm.","commonSituations":"Confusing HMAC vs RSA/ECDSA key generation; loops that iterate all SignatureAlgorithm values and generate keys indiscriminately; legacy code after migrating to JJWT 0.12.x APIs.","solutions":["Only call secretKeyFor with HMAC algorithms: HS256, HS384, HS512","Use Keys.keyPairFor(alg) instead for asymmetric algorithms","Prefer the modern API: Jwts.SIG.HS256.key().build() (or the matching SIG instance)","Check alg.name().startsWith(\"HS\") before generating a secret key"],"exampleFix":"// before\nSecretKey key = Keys.secretKeyFor(SignatureAlgorithm.RS256); // throws\n// after\nKeyPair kp = Keys.keyPairFor(SignatureAlgorithm.RS256); // asymmetric path\nSecretKey key = Keys.secretKeyFor(SignatureAlgorithm.HS256); // for HMAC","handlingStrategy":"type-guard","validationCode":"if (!alg.name().startsWith(\"HS\")) throw new IllegalArgumentException(alg + \" is asymmetric; use keyPairFor\");","typeGuard":"static boolean isHmac(io.jsonwebtoken.SignatureAlgorithm alg) {\n    return alg != null && alg.name().startsWith(\"HS\");\n}","tryCatchPattern":"try {\n    SecretKey key = Keys.secretKeyFor(alg);\n} catch (IllegalArgumentException e) {\n    KeyPair kp = Keys.keyPairFor(alg); // fall back to asymmetric generation\n}","preventionTips":["Branch on algorithm family before generating keys: HS* -> secretKeyFor, others -> keyPairFor","Prefer the modern Jwts.SIG.<Alg>.key()/keyPair() builders over deprecated helpers","Write tests asserting key generation per SignatureAlgorithm constant"],"tags":["java","jjwt","deprecated-api","key-generation"],"backgroundTag":"deprecated-api-usage","analyzedSha":"fb71496164c71442d08adec4571d9616ed5e1b8d","analyzedAt":"2026-09-09T00:33:09.982Z","contentChangedAt":"2026-09-09T00:33:09.982Z","schemaVersion":2},"datasetVersion":"2026-09-17T15:17:12.973Z"}