dgraph-io/dgraph · error

Unsupported JWT signing algorithm for ACL: %v

Error message

Unsupported JWT signing algorithm for ACL: %v

What it means

GetEncAclKeys reads the configured JWT algorithm string (flagAclJwtAlg) and resolves it with jwt.GetSigningMethod. If the string is not a recognized golang-jwt signing method (e.g. misspelled or an unsupported alg), aclAlg is nil and this error is returned before any key parsing.

Source

Thrown at x/acl_enc_keys.go:81

		}
		var err error
		if aclKey, err = os.ReadFile(aclSecretFile); err != nil {
			return nil, fmt.Errorf("error reading ACL secret key from file: %s: %s", aclSecretFile, err)
		}
	}

	keys := &Keys{
		AclSecretKeyBytes: aclKey,
		AclAccessTtl:      aclSuperFlag.GetDuration(flagAclAccessTtl),
		AclRefreshTtl:     aclSuperFlag.GetDuration(flagAclRefreshTtl),
		EncKey:            encKey,
	}

	if aclKey != nil {
		algStr := aclSuperFlag.GetString(flagAclJwtAlg)
		aclAlg := jwt.GetSigningMethod(algStr)
		if aclAlg == nil {
			return nil, fmt.Errorf("Unsupported JWT signing algorithm for ACL: %v", algStr)
		}
		if err := checkAclKeyLength(aclAlg, aclKey); err != nil {
			return nil, err
		}
		privKey, pubKey, err := parseJWTKey(aclAlg, aclKey)
		if err != nil {
			return nil, err
		}

		keys.AclJwtAlg = aclAlg
		keys.AclSecretKey = privKey
		keys.AclPublicKey = pubKey
	}

	return keys, nil
}

func parseJWTKey(alg jwt.SigningMethod, key Sensitive) (interface{}, interface{}, error) {

View on GitHub (pinned to 759e242be6)

Solutions

1. Set jwt-alg to one of the exact supported values: HS256/HS384/HS512, RS256/RS384/RS512, PS*, ES256/ES384/ES512, EdDSA
2. Use uppercase as golang-jwt's GetSigningMethod expects
3. Remove the jwt-alg component to fall back to the default
4. Check the message's %v to see exactly what string was passed

Example fix

// before
--acl "hmac-secret=...;jwt-alg=rs256"
// after
--acl "hmac-secret=...;jwt-alg=RS256"

alg := "HS256" // or RS256, ES256, EdDSA...
if jwt.GetSigningMethod(alg) == nil {
    return fmt.Errorf("unsupported jwt alg %q; use HS256/384/512, RS/PS/ES*, EdDSA", alg)
}
_, err := x.GetEncAclKeys(aclSuperFlag, encKey)

if _, err := x.GetEncAclKeys(flag, encKey); err != nil {
    if strings.Contains(err.Error(), "Unsupported JWT signing algorithm") {
        log.Fatalf("fix jwt-alg value: %v", err)
    }
    return err
}

When it happens

Trigger: Setting the ACL jwt-alg superflag component to an unknown/misspelled algorithm name, empty string, or an algorithm not compiled in (e.g. 'rs256' lowercase vs 'RS256', 'HS512 ' with whitespace).

Common situations: Typo in the dgraph --acl flag; copying an algorithm name from a different JWT library with different casing; expecting RS384 support when the vendored jwt lib lacks it.

Related errors

• error finding sha length for algo %v
• ACL is disabled
• Authorize guardian of the galaxy, extracting jwt token, erro
• required field missing in Dgraph.Authorization:%s
• claims in jwt token is not map claims

AI-assisted analysis of dgraph-io/dgraph@759e242be6 (2026-09-01). Data as JSON: /api/errors/adae1dfe9ceb2558. Report an issue: GitHub.