grafana/k6 · error

invalid EC JWK key: %w

Error message

invalid EC JWK key: %w

What it means

After JSON parsing, the EC JWK is checked by ecJWK.validate(): kty must equal 'EC' (exact case) and crv, x and y must be non-empty strings. This error wraps any of those validation failures and is returned from importKey('jwk', ...) for ECDSA keys. The wrapped message names the actual problem ('invalid key type: ...', 'curve is required', 'coordinate X is required', 'coordinate Y is required').

Source

Thrown at internal/js/modules/k6/webcrypto/jwk.go:228

	exported.Set("x", base64URLEncode(x.Bytes()))
	exported.Set("y", base64URLEncode(y.Bytes()))

	if d != nil {
		exported.Set("d", encodeCurveBigInt(d, curveBits))
	}

	return exported, nil
}

func importECDSAJWK(_ EllipticCurveKind, jsonKeyData []byte) (any, CryptoKeyType, error) {
	var jwkKey ecJWK
	if err := json.Unmarshal(jsonKeyData, &jwkKey); err != nil {
		return nil, UnknownCryptoKeyType, fmt.Errorf("failed to parse input as EC JWK key: %w", err)
	}

	if err := jwkKey.validate(); err != nil {
		return nil, UnknownCryptoKeyType, fmt.Errorf("invalid EC JWK key: %w", err)
	}

	crv, err := pickEllipticCurve(jwkKey.Crv)
	if err != nil {
		return nil, UnknownCryptoKeyType, fmt.Errorf("failed to parse elliptic curve: %w", err)
	}

	x, err := base64URLDecode(jwkKey.X)
	if err != nil {
		return nil, UnknownCryptoKeyType, fmt.Errorf("failed to decode X coordinate: %w", err)
	}

	y, err := base64URLDecode(jwkKey.Y)
	if err != nil {
		return nil, UnknownCryptoKeyType, fmt.Errorf("failed to decode Y coordinate: %w", err)
	}

	pk := &ecdsa.PublicKey{

View on GitHub (pinned to 93accf6570)

Solutions

1. Set kty to exactly 'EC'
2. Include non-empty crv, x and y string fields
3. Match the JWK's kty with the algorithm passed to importKey (EC JWK for ECDSA/ECDH, RSA JWK for RSA algorithms)
4. Read the wrapped message after 'invalid EC JWK key:' to see which field failed

Example fix

// before
const jwk = { kty: 'ec', crv: 'P-256', x: 'abc...' }; // wrong case + missing y
const key = await crypto.subtle.importKey('jwk', jwk, alg, true, ['verify']);
// after
const jwk = { kty: 'EC', crv: 'P-256', x: 'abc...', y: 'def...' };

function isValidEcJwk(jwk) {
  return jwk && typeof jwk === 'object' &&
    jwk.kty === 'EC' &&
    typeof jwk.crv === 'string' && jwk.crv !== '' &&
    typeof jwk.x === 'string' && jwk.x !== '' &&
    typeof jwk.y === 'string' && jwk.y !== '';
}
if (!isValidEcJwk(jwk)) throw new Error('EC JWK must have kty="EC" and non-empty crv, x, y');

function isEcJwk(jwk) {
  return !!jwk && typeof jwk === 'object' &&
    jwk.kty === 'EC' &&
    typeof jwk.crv === 'string' && jwk.crv.length > 0 &&
    typeof jwk.x === 'string' && jwk.x.length > 0 &&
    typeof jwk.y === 'string' && jwk.y.length > 0;
}

try {
  key = await crypto.subtle.importKey('jwk', jwk, alg, true, usages);
} catch (e) {
  if (e.message.includes('invalid EC JWK key')) console.error('JWK shape invalid:', jwk.kty, jwk.crv, !!jwk.x, !!jwk.y);
  throw e;
}

When it happens

Trigger: importKey('jwk', jwk, {name:'ECDSA',...}) with kty not exactly 'EC' (e.g. 'ec', 'RSA', 'oct'); a JWK with crv, x or y missing or empty; a symmetric or RSA JWK mistakenly fed to the ECDSA importer.

Common situations: Mixing up key families (passing an RSA JWK to an ECDSA algorithm object); case-normalized kty values from case-insensitive systems; partial JWKs copied from documentation or JWT headers (which lack x/y).

Related errors

• failed to parse input as EC JWK key: %w
• failed to parse elliptic curve: %w
• failed to decode X coordinate: %w
• failed to decode Y coordinate: %w
• failed to decode D: %w

AI-assisted analysis of grafana/k6@93accf6570 (2026-08-15). Data as JSON: /api/errors/0e0bf934ee8231ca. Report an issue: GitHub.