jwtk/jjwt · error · UnsupportedJwtException

The specified SigningKeyResolver implementation does not…

Error message

The specified SigningKeyResolver implementation does not support Claims JWS signing key resolution.  Consider overriding either the resolveSigningKey(JwsHeader, Claims) method or, for HMAC algorithms, the resolveSigningKeyBytes(JwsHeader, Claims) method.

What it means

Error "The specified SigningKeyResolver implementation does not support Claims JWS signing key resolution. Consider overriding either the resolveSigningKey(JwsHeader, Claims) method or, for HMAC algorithms, the resolveSigningKeyBytes(JwsHeader, Claims) method." thrown in jwtk/jjwt.

Solutions

1. In your SigningKeyResolver subclass, override resolveSigningKey(JwsHeader, Claims) or, for HMAC, resolveSigningKeyBytes(JwsHeader, Claims) to return the Claims-JWS signing key.
2. If your tokens are content (non-Claims) JWSs, use the byte[]-based overrides instead and ensure the resolver is matched to the token kind.
3. Do not use SigningKeyResolverAdapter for token types you have not implemented overrides for — implement the SigningKeyResolver interface fully or extend with the right methods.

When it happens

Trigger: Thrown at api/src/main/java/io/jsonwebtoken/SigningKeyResolverAdapter.java:101 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/fbcc99c117426bd8. Report an issue: GitHub.

Appendix: source

Thrown at api/src/main/java/io/jsonwebtoken/SigningKeyResolverAdapter.java:101

                "Key instance appropriate for the " + alg.name() + " algorithm.");
        byte[] keyBytes = resolveSigningKeyBytes(header, content);
        return new SecretKeySpec(keyBytes, alg.getJcaName());
    }

    /**
     * Convenience method invoked by {@link #resolveSigningKey(JwsHeader, Claims)} that obtains the necessary signing
     * key bytes.  This implementation simply throws an exception: if the JWS parsed is a Claims JWS, you must
     * override this method or the {@link #resolveSigningKey(JwsHeader, Claims)} method instead.
     *
     * <p><b>NOTE:</b> You cannot override this method when validating RSA signatures.  If you expect RSA signatures,
     * you must override the {@link #resolveSigningKey(JwsHeader, Claims)} method instead.</p>
     *
     * @param header the parsed {@link JwsHeader}
     * @param claims the parsed {@link Claims}
     * @return the signing key bytes to use to verify the JWS signature.
     */
    public byte[] resolveSigningKeyBytes(JwsHeader header, Claims claims) {
        throw new UnsupportedJwtException("The specified SigningKeyResolver implementation does not support " +
                "Claims JWS signing key resolution.  Consider overriding either the " +
                "resolveSigningKey(JwsHeader, Claims) method or, for HMAC algorithms, the " +
                "resolveSigningKeyBytes(JwsHeader, Claims) method.");
    }

    /**
     * Convenience method invoked by {@link #resolveSigningKey(JwsHeader, byte[])} that obtains the necessary signing
     * key bytes.  This implementation simply throws an exception: if the JWS parsed is a content JWS, you must
     * override this method or the {@link #resolveSigningKey(JwsHeader, byte[])} method instead.
     *
     * @param header  the parsed {@link JwsHeader}
     * @param content the byte array payload
     * @return the signing key bytes to use to verify the JWS signature.
     */
    @SuppressWarnings("unused")
    public byte[] resolveSigningKeyBytes(JwsHeader header, byte[] content) {
        throw new UnsupportedJwtException("The specified SigningKeyResolver implementation does not support " +
                "content JWS signing key resolution.  Consider overriding either the " +

View on GitHub (pinned to fb71496164)