{"record":{"id":"f4fdca32276c8253","repo":"ory/hydra","slug":"could-not-convert-key-to-rsa-public-key-got-t","errorCode":null,"errorMessage":"Could not convert key to RSA Public Key, got: %T","messagePattern":"Could not convert key to RSA Public Key, got: %T","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"jwk/cast.go","lineNumber":28,"sourceCode":"\n\tjose \"github.com/go-jose/go-jose/v3\"\n\t\"github.com/pkg/errors\"\n)\n\nfunc MustRSAPublic(key *jose.JSONWebKey) *rsa.PublicKey {\n\tres, err := ToRSAPublic(key)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\n\treturn res\n}\n\nfunc ToRSAPublic(key *jose.JSONWebKey) (*rsa.PublicKey, error) {\n\tpk := josex.ToPublicKey(key)\n\tres, ok := pk.Key.(*rsa.PublicKey)\n\tif !ok {\n\t\treturn res, errors.Errorf(\"Could not convert key to RSA Public Key, got: %T\", pk.Key)\n\t}\n\n\treturn res, nil\n}\n\nfunc MustRSAPrivate(key *jose.JSONWebKey) *rsa.PrivateKey {\n\tres, err := ToRSAPrivate(key)\n\tif err != nil {\n\t\tpanic(err.Error())\n\t}\n\n\treturn res\n}\n\nfunc ToRSAPrivate(key *jose.JSONWebKey) (*rsa.PrivateKey, error) {\n\tres, ok := key.Key.(*rsa.PrivateKey)\n\tif !ok {\n\t\treturn res, errors.New(\"Could not convert key to RSA Private Key.\")","sourceCodeStart":10,"sourceCodeEnd":46,"githubUrl":"https://github.com/ory/hydra/blob/4174065ffb052799890f7480f5360a877a67ffc1/jwk/cast.go#L10-L46","documentation":"jwk.ToRSAPublic converts a *jose.JSONWebKey to *rsa.PublicKey; if the key's underlying Key is not an RSA public key the cast fails and this error is returned. It indicates the JWK being consumed is EC/OKP/symmetric rather than RSA.","triggerScenarios":"Calling ToRSAPublic (public) on a JWK parsed from a JWKS or id_token header whose key type (kty) is not RSA — e.g. EC (P-256) or oct keys — typically via MustRSAPublic during token verification or client key handling.","commonSituations":"OIDC providers publishing ES256 signing keys while the consumer assumes RS256/RSA; fetching a JWKS where the selected kid points at an EC key; hardcoding RSA assumptions when migrating providers.","solutions":["Select the RSA key from the JWKS (filter by kty == \"RSA\" or the alg/kid actually used to sign)","Use a generic verifier that dispatches on key type (e.g. jose's verifier with the JSONWebKey directly) instead of forcing RSA conversion","If the provider uses EC keys, switch your verification logic to ToECPublic / ECDSA verification","Before calling, guard: if k, _ := josex.ToPublicKey(jwk); _, ok := k.Key.(*rsa.PublicKey); !ok { handle non-RSA path }"],"exampleFix":"// before\nrsaKey, err := jwk.ToRSAPublic(jwks.Key(0)) // key 0 may be EC\n// after\nvar rsaKey *rsa.PublicKey\nfor _, k := range jwks.Keys {\n    if k.Kty == \"RSA\" {\n        rsaKey, err = jwk.ToRSAPublic(&k)\n        break\n    }\n}","handlingStrategy":"type-guard","validationCode":"func isRSAJWK(j *jose.JSONWebKey) bool {\n    pk, err := jwk.ToRSAPublic(j)\n    return err == nil && pk != nil\n}\n// use before calling ToRSAPublic\nif !isRSAJWK(candidate) { select another key from the JWKS }","typeGuard":"func asRSAPublic(j *jose.JSONWebKey) (*rsa.PublicKey, bool) {\n    pk, err := jwk.ToRSAPublic(j)\n    if err != nil || pk == nil { return nil, false }\n    return pk, true\n}","tryCatchPattern":"rsaKey, err := jwk.ToRSAPublic(key)\nif err != nil && strings.Contains(err.Error(), \"Could not convert key to RSA Public Key\") {\n    // fall back to EC verification or pick an RSA key from the JWKS\n    return verifyWithJWKey(rawToken, key)\n}","preventionTips":["Filter JWKS keys by kty==\"RSA\" (and the signing alg/kid) before RSA conversion","Support ECDSA verification for providers that publish ES256 keys","Never assume key type from the provider; read kty/alg from the JWK","Cache JWKS per kid and re-check key type on rotation"],"tags":["jwt","jose","jwk","key-type","type-assertion"],"backgroundTag":"unsupported-jwk-key-type","analyzedSha":"4174065ffb052799890f7480f5360a877a67ffc1","analyzedAt":"2026-09-03T14:52:41.581Z","contentChangedAt":"2026-09-03T14:52:41.581Z","schemaVersion":2},"datasetVersion":"2026-09-10T17:17:09.494Z"}