Invalid key for this operation, its RSA-PSS parameter…

Error message

Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${algorithm}.

What it means

Beyond hash parameters, RSA-PSS keys carry a saltLength. The PS* algorithm's salt length is bits(algorithm)/8 (e.g. PS256 -> 32 bytes); if the key's saltLength is defined and larger than that, jsonwebtoken rejects the key because the resulting signature would not conform to the algorithm's expected salt length.

Solutions

Regenerate the PSS key with salt length <= the algorithm's byte length (e.g. rsa_pss_keygen_saltlen:32 for PS256)
Or select the PS* algorithm whose salt length (alg bits / 8) accommodates the key's saltLength
Set options to a matching salt length or fall back to RS256 with a standard RSA key

Example fix

// before
openssl genpkey -algorithm RSA-PSS -pkeyopt rsa_pss_keygen_saltlen:62 -out key.pem  # used with PS256
// after
openssl genpkey -algorithm RSA-PSS -pkeyopt rsa_pss_keygen_saltlen:32 -out key.pem

Defensive patterns

Strategy: validation

Validate before calling

function pssSaltLengthOk(alg, key) {
  if (!/^PS/.test(alg)) return true;
  const bytes = parseInt(alg.slice(2), 10) >> 3;
  const s = key.asymmetricKeyDetails?.saltLength;
  return s === undefined || s <= bytes;
}
if (!pssSaltLengthOk(alg, key)) throw new Error('PSS saltLength ' + key.asymmetricKeyDetails.saltLength + ' exceeds ' + alg + ' requirement');

Type guard

function hasAcceptablePssSaltLength(alg, key) {
  const maxBytes = parseInt(alg.replace(/^PS/, ''), 10) >> 3;
  const s = key.asymmetricKeyDetails?.saltLength;
  return s === undefined || s <= maxBytes;
}

Try / catch

try {
  return jwt.sign(payload, pssKey, { algorithm: alg });
} catch (err) {
  if (/saltLength does not meet/.test(err.message)) {
    // degrade to RS256 with the PKCS#1 variant of the key or regenerate
    throw new Error('Regenerate PSS key with saltLength <= ' + (parseInt(alg.slice(2), 10) >> 3));
  }
  throw err;
}

Prevention

Set rsa_pss_keygen_saltlen explicitly to the algorithm's byte length when generating keys
Verify saltLength on imported HSM/KMS keys before use
Avoid mixing salt lengths across signing and verifying environments
Document the PS* variant per key in your key inventory

When it happens

Trigger: Signing/verifying with PS256/PS384/PS512 using an RSA-PSS KeyObject whose asymmetricKeyDetails.saltLength exceeds length>>3 (e.g. a key with saltLength 64 used with PS256), on Node versions exposing RSA-PSS key details.

Common situations: Keys generated by OpenSSL or HSM tooling with a custom/optimal salt length (often equal to hash length or larger) then used with a different PS* variant; HSM/KMS-exported PSS keys with enforced salt lengths.

Related errors

AI-assisted analysis of auth0/node-jsonwebtoken@b924272f29 (2026-09-02). Data as JSON: /api/errors/522073b24bc25073. Report an issue: GitHub.

Appendix: source

Thrown at lib/validateAsymmetricKey.js:60

      const keyCurve = key.asymmetricKeyDetails.namedCurve;
      const allowedCurve = allowedCurves[algorithm];

      if (keyCurve !== allowedCurve) {
        throw new Error(`"alg" parameter "${algorithm}" requires curve "${allowedCurve}".`);
      }
      break;

    case 'rsa-pss':
      if (RSA_PSS_KEY_DETAILS_SUPPORTED) {
        const length = parseInt(algorithm.slice(-3), 10);
        const { hashAlgorithm, mgf1HashAlgorithm, saltLength } = key.asymmetricKeyDetails;

        if (hashAlgorithm !== `sha${length}` || mgf1HashAlgorithm !== hashAlgorithm) {
          throw new Error(`Invalid key for this operation, its RSA-PSS parameters do not meet the requirements of "alg" ${algorithm}.`);
        }

        if (saltLength !== undefined && saltLength > length >> 3) {
          throw new Error(`Invalid key for this operation, its RSA-PSS parameter saltLength does not meet the requirements of "alg" ${algorithm}.`)
        }
      }
      break;
    }
  }
}

View on GitHub (pinned to b924272f29)