dgraph-io/dgraph · error

invalid jwt algorithm: found %s, but supported options are:

Error message

invalid jwt algorithm: found %s, but supported options are: %s

What it means

This error is thrown by the JWT authorization layer when the algorithm specified in the auth configuration (a.Algo) is not present in the set of algorithms the library supports (e.g. HS256, RS256). initSigningMethod looks up the configured algorithm in supportedAlgorithms and returns this formatted error listing all valid options when the lookup fails. It prevents the server from signing/verifying tokens with an unrecognized algorithm.

Source

Thrown at graphql/authorization/auth.go:541

	return time.Now().After(a.expiryTime[i])
}

// initSigningMethod takes the current Algo value, validates it's a supported SigningMethod, then sets the SigningMethod
// field.
func (a *AuthMeta) initSigningMethod() error {
	// configurations using JWK URLs do not use signing methods.
	if len(a.JWKUrls) != 0 || a.JWKUrl != "" {
		return nil
	}

	signingMethod, ok := supportedAlgorithms[a.Algo]
	if !ok {
		arr := make([]string, 0, len(supportedAlgorithms))
		for k := range supportedAlgorithms {
			arr = append(arr, k)
		}

		return errors.Errorf(
			"invalid jwt algorithm: found %s, but supported options are: %s",
			a.Algo, strings.Join(arr, ","),
		)
	}

	a.SigningMethod = signingMethod

	return nil
}

func (a *AuthMeta) InitHttpClient() {
	a.httpClient = &http.Client{
		Timeout: 30 * time.Second,
	}
}

View on GitHub (pinned to 759e242be6)

Solutions

1. Check the @auth directive / JWT config and set algorithm to an exactly matching supported name (e.g. HS256, RS256)
2. Fix casing — algorithm names are case-sensitive in supportedAlgorithms
3. Run the query printing supportedAlgorithms from the error message and pick one from that list
4. Upgrade to a version that supports the algorithm you need, or switch signing keys to a supported algorithm

Example fix

// before
# @auth(query: "...", algorithm: "RS512")
// after
# @auth(query: "...", algorithm: "RS256")

const supported = ["HS256","RS256","RS384","RS512","ES256"];
function validateAlgo(algo) {
  if (!supported.includes(algo)) {
    throw new Error(`invalid jwt algorithm: ${algo}; supported: ${supported.join(",")}`);
  }
}

function isSupportedAlgo(a) { return typeof a === 'string' && ['HS256','RS256','RS384','RS512','ES256'].includes(a); }

When it happens

Trigger: The GraphQL @auth directive (or config) declares a JWT algorithm string that is not one of the supported options, e.g. typo like 'hs256' vs 'HS256', 'RS512' when unsupported, or an empty Algo value.

Common situations: Typos in schema @auth(algorithm: ...) annotations; copying a config between libraries with different algorithm casing or sets; upgrading a library that dropped support for an older algorithm; leaving the algo field empty in the admin config.

Related errors

• expecting either JWKUrl or JWKUrls, both were given
• expecting either JWKUrl/JWKUrls or (VerificationKey, Algo),
• required field missing in Dgraph.Authorization:%s
• audience value was expected but not provided
• jwt token cannot be validated because verification algorithm

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/39039ca30a143a38. Report an issue: GitHub.