jwtk/jjwt · error · InvalidKeyException
Key argument cannot be null.
Error message
Key argument cannot be null.
What it means
Null-guard at the top of SignatureAlgorithm.forSigningKey(Key): this static helper inspects a key to recommend a compatible signature algorithm, and a null argument provides nothing to inspect, so InvalidKeyException is thrown immediately before any instanceof or size heuristics run.
Solutions
- Ensure the key is initialized before calling forSigningKey — check key loading/derivation code that returned null.
- Guard the call site with a null check and fail with a clearer application-level error.
- Load keys via Keys.* factory methods or a keystore so a non-null Key is guaranteed.
Defensive patterns
Strategy: validation
When it happens
Trigger: Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:573 when the library encounters an invalid state.
Common situations: See trigger scenarios.
AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09).
Data as JSON: /api/errors/135c8fc630a58ceb.
Report an issue: GitHub.
Appendix: source
Thrown at api/src/main/java/io/jsonwebtoken/SignatureAlgorithm.java:573
* recommended algorithms while the {@code PS}* variants are simply marked as optional.</li>
* <li>The {@link #RS256}, {@link #RS384}, and {@link #RS512} algorithms are available in the JDK by default
* while the {@code PS}* variants require an additional JCA Provider (like BouncyCastle).</li>
* </ul>
*
* <p>Finally, this method will throw an {@link InvalidKeyException} for any key that does not match the
* heuristics and requirements documented above, since that inevitably means the Key is either insufficient or
* explicitly disallowed by the JWT specification.</p>
*
* @param key the key to inspect
* @return the recommended signature algorithm to be used with the specified key
* @throws InvalidKeyException for any key that does not match the heuristics and requirements documented above,
* since that inevitably means the Key is either insufficient or explicitly disallowed by the JWT specification.
* @since 0.10.0
*/
public static SignatureAlgorithm forSigningKey(Key key) throws InvalidKeyException {
if (key == null) {
throw new InvalidKeyException("Key argument cannot be null.");
}
if (!(key instanceof SecretKey ||
(key instanceof PrivateKey && (key instanceof ECKey || key instanceof RSAKey)))) {
String msg = "JWT standard signing algorithms require either 1) a SecretKey for HMAC-SHA algorithms or " +
"2) a private RSAKey for RSA algorithms or 3) a private ECKey for Elliptic Curve algorithms. " +
"The specified key is of type " + key.getClass().getName();
throw new InvalidKeyException(msg);
}
if (key instanceof SecretKey) {
SecretKey secretKey = (SecretKey) key;
byte[] encoded = EMPTY_BYTES;
int bitLength;
try {
encoded = secretKey.getEncoded();
bitLength = io.jsonwebtoken.lang.Arrays.length(encoded) * Byte.SIZE;View on GitHub (pinned to fb71496164)