auth0/node-jsonwebtoken · error

Unknown key type "${keyType}".

Error message

Unknown key type "${keyType}".

What it means

jsonwebtoken validates that the asymmetric key's type (from Node's key.asymmetricKeyType) is one it knows and supports for JWT signing/verification. If the key object has an asymmetric key type that is not in the library's allowedAlgorithmsForKeys map, it throws this error because it cannot determine which 'alg' values are safe for that key.

Source

Thrown at lib/validateAsymmetricKey.js:25

  'rsa-pss': ['PS256', 'PS384', 'PS512']
};

const allowedCurves = {
  ES256: 'prime256v1',
  ES384: 'secp384r1',
  ES512: 'secp521r1',
};

module.exports = function(algorithm, key) {
  if (!algorithm || !key) return;

  const keyType = key.asymmetricKeyType;
  if (!keyType) return;

  const allowedAlgorithms = allowedAlgorithmsForKeys[keyType];

  if (!allowedAlgorithms) {
    throw new Error(`Unknown key type "${keyType}".`);
  }

  if (!allowedAlgorithms.includes(algorithm)) {
    throw new Error(`"alg" parameter for "${keyType}" key type must be one of: ${allowedAlgorithms.join(', ')}.`)
  }

  /*
   * Ignore the next block from test coverage because it gets executed
   * conditionally depending on the Node version. Not ignoring it would
   * prevent us from reaching the target % of coverage for versions of
   * Node under 15.7.0.
   */
  /* istanbul ignore next */
  if (ASYMMETRIC_KEY_DETAILS_SUPPORTED) {
    switch (keyType) {
    case 'ec':
      const keyCurve = key.asymmetricKeyDetails.namedCurve;
      const allowedCurve = allowedCurves[algorithm];

View on GitHub (pinned to b924272f29)

Solutions

  1. Upgrade jsonwebtoken to the latest version, which supports EdDSA and more key types
  2. Use an RSA ('RS256') or EC ('ES256') key instead of the unsupported key type
  3. If using Ed25519/EdDSA, verify your jsonwebtoken version is >= 8.5 and Node >= 12
  4. Pass a PEM/secret string instead of a KeyObject if the key type is genuinely unsupported

Example fix

// before
const { privateKey } = crypto.generateKeyPairSync('ed25519');
jwt.sign(payload, privateKey, { algorithm: 'EdDSA' }); // old lib: Unknown key type "ed25519"
// after
npm install jsonwebtoken@latest
jwt.sign(payload, privateKey, { algorithm: 'EdDSA' });
Defensive patterns

Strategy: validation

Validate before calling

const { createPublicKey } = require('crypto');
function isSupportedAsymmetricKey(key) {
  if (typeof key === 'string' || Buffer.isBuffer(key)) return true;
  const t = key.asymmetricKeyType;
  return ['rsa', 'rsa-pss', 'ec', 'ed25519'].includes(String(t));
}
if (!isSupportedAsymmetricKey(key)) throw new Error('Unsupported key type: ' + (key.asymmetricKeyType || 'secret/none'));

Type guard

function isKeyObjectWithSupportedType(k) {
  return typeof k === 'object' && k !== null && 'asymmetricKeyType' in k &&
    ['rsa', 'rsa-pss', 'ec', 'ed25519'].includes(String(k.asymmetricKeyType));
}

Try / catch

try {
  token = jwt.sign(payload, key, opts);
} catch (err) {
  if (/Unknown key type/.test(err.message)) {
    throw new Error('Key type ' + key.asymmetricKeyType + ' unsupported by this jsonwebtoken version; upgrade the lib or use RSA/EC');
  }
  throw err;
}

Prevention

When it happens

Trigger: jwt.sign() or jwt.verify() is called with a KeyObject whose asymmetricKeyType is an unsupported type (e.g. 'ed25519', 'x25519', 'dh', 'dsa' on Node versions without support), passed as secretOrPrivateKey/secretOrPublicKey.

Common situations: Generating modern Ed25519/X25519 keys with crypto.generateKeyPair and passing them to an older jsonwebtoken version that only maps RSA/EC/PKCS types; passing a DH or generic key object; upgrading Node to a version that surfaces new key types the library version predates.

Related errors

AI-assisted analysis of auth0/node-jsonwebtoken@b924272f29 (2026-09-02). Data as JSON: /api/errors/330af89d1ee2f211. Report an issue: GitHub.