{"record":{"id":"ef8912473a0e5da3","repo":"ory/hydra","slug":"unsupported-key-algorithm-s","errorCode":null,"errorMessage":"unsupported key algorithm: %s","messagePattern":"unsupported key algorithm: (.+?)","errorType":"error_code","errorClass":"jwk.ErrUnsupportedKeyAlgorithm","httpStatus":null,"severity":"error","filePath":"persistence/sql/persister_jwk.go","lineNumber":47,"sourceCode":"\t}\n}\n\n// GenerateAndPersistKeySet implements jwk.Manager.\nfunc (p *JWKPersister) GenerateAndPersistKeySet(ctx context.Context, set, kid, alg, use string) (_ *jose.JSONWebKeySet, err error) {\n\tctx, span := p.D.Tracer(ctx).Tracer().Start(ctx, \"persistence.sql.GenerateAndPersistKeySet\",\n\t\ttrace.WithAttributes(\n\t\t\tattribute.String(\"set\", set),\n\t\t\tattribute.String(\"kid\", kid),\n\t\t\tattribute.String(\"alg\", alg)))\n\tdefer otelx.End(span, &err)\n\n\tif kid == \"\" {\n\t\tkid = uuid.Must(uuid.NewV4()).String()\n\t}\n\n\tkeys, err := jwk.GenerateJWK(jose.SignatureAlgorithm(alg), kid, use)\n\tif err != nil {\n\t\treturn nil, errors.Wrapf(jwk.ErrUnsupportedKeyAlgorithm, \"%s\", err)\n\t}\n\n\terr = p.AddKeySet(ctx, set, keys)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\n\treturn keys, nil\n}\n\n// AddKey implements jwk.Manager.\nfunc (p *JWKPersister) AddKey(ctx context.Context, set string, key *jose.JSONWebKey) (err error) {\n\tctx, span := p.D.Tracer(ctx).Tracer().Start(ctx, \"persistence.sql.AddKey\",\n\t\ttrace.WithAttributes(\n\t\t\tattribute.String(\"set\", set),\n\t\t\tattribute.String(\"kid\", key.KeyID)))\n\tdefer otelx.End(span, &err)\n","sourceCodeStart":29,"sourceCodeEnd":65,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/persistence/sql/persister_jwk.go#L29-L65","documentation":"GenerateAndPersistKeySet wraps jwk.ErrUnsupportedKeyAlgorithm when jwk.GenerateJWK rejects the algorithm string supplied for the key set. The library only supports a fixed set of JOSE signature algorithms (e.g. RS256, ES256, HS256, EdDSA); anything else — an empty/typo'd alg or a deprecated/unsupported one — produces \"unsupported key algorithm: %s\". This error originates in ory/x jwk, not the database layer.","triggerScenarios":"Calling the JWK generation/admin API (PUT /admin/keys/{set}) or GenerateAndPersistKeySet with alg values like RS512, PS256 (unsupported builds), \"rsa\", \"\" or a misspelled name; config mis-defining key generators for the OAuth2 signer.","commonSituations":"Copy-pasting alg names from other stacks (\"HS512\" with wrong case, \"ECDSA\"), driving the CLI hydra keys create with a wrong --alg flag, upgrading versions where support for an algorithm was dropped.","solutions":["Use a supported algorithm, e.g. RS256, ES256, HS256 or EdDSA, matching case exactly.","Check the jwk.SupportedAlgorithms / GenerateJWK source for the exact allow-list in your version.","If config (strategies / key generator settings) references the algorithm, correct the identifier there.","For ECDSA keys ensure the full name like ES256 rather than a generic family name."],"exampleFix":"// before\ncurl -X PUT .../admin/keys/my-set --data '{\"alg\":\"RS512\",\"use\":\"sig\"}'\n// after\ncurl -X PUT .../admin/keys/my-set --data '{\"alg\":\"RS256\",\"use\":\"sig\"}'","handlingStrategy":"validation","validationCode":"alg := \"RS256\" // must be one of RS256, ES256, HS256, EdDSA (see jwk.GenerateJWK)\nif !slices.Contains([]string{\"RS256\", \"ES256\", \"HS256\", \"EdDSA\"}, alg) {\n    return fmt.Errorf(\"unsupported key algorithm: %s\", alg)\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Validate alg against the supported list before calling GenerateAndPersistKeySet or the keys admin API.","Use exact JOSE algorithm identifiers (case-sensitive); never generic names like rsa/ecdsa.","Pin and review the ory/x version's supported algorithm list when upgrading."],"tags":["jose","jwk","crypto","validation"],"backgroundTag":"unsupported-key-algorithm","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}