jwtk/jjwt · error · IllegalArgumentException

Unsupported JwkContext.

Error message

Unsupported JwkContext.

What it means

createJwk asserts the JwkContext passed in is supported by this factory (supports(ctx) returned true), throwing IllegalArgumentException otherwise. Normally a dispatcher selects the right factory, so this guards against programmatic misuse of the internal API.

Source

Thrown at impl/src/main/java/io/jsonwebtoken/impl/security/AbstractFamilyJwkFactory.java:105

            public T apply(KeyFactory instance) {
                try {
                    return fn.apply(instance);
                } catch (KeyException keyException) {
                    throw keyException; // propagate
                } catch (Exception e) {
                    String msg = "Unable to create " + type.getSimpleName() + " from JWK " + ctx + ": " + e.getMessage();
                    throw new InvalidKeyException(msg, e);
                }
            }
        });
    }

    @Override
    public final J createJwk(JwkContext<K> ctx) {
        Assert.notNull(ctx, "JwkContext argument cannot be null.");
        if (!supports(ctx)) { //should be asserted by caller, but assert just in case:
            String msg = "Unsupported JwkContext.";
            throw new IllegalArgumentException(msg);
        }
        K key = ctx.getKey();
        if (key != null) {
            ctx.setType(this.ktyValue);
            return createJwkFromKey(ctx);
        } else {
            return createJwkFromValues(ctx);
        }
    }

    //when called, ctx.getKey() is guaranteed to be non-null
    protected abstract J createJwkFromKey(JwkContext<K> ctx);

    //when called ctx.getType() is guaranteed to equal this.ktyValue
    protected abstract J createJwkFromValues(JwkContext<K> ctx);
}

View on GitHub (pinned to fb71496164)

Solutions

1. Create JWKs via Jwks.builder() so the correct factory is chosen automatically.
2. Ensure the JwkContext key type matches the factory you invoke (check ctx.getKty()).
3. Call factory.supports(ctx) before createJwk in custom dispatch code.
4. Wrap the call in try-catch for IllegalArgumentException if inputs are untrusted.

Example fix

// before
EccJwkFactory f = new EccJwkFactory();
f.createJwk(rsaContext);
// after
if (f.supports(ctx)) { f.createJwk(ctx); } else { Jwks.builder().setContext(ctx).build(); }

if (!factory.supports(ctx)) { throw new IllegalArgumentException("kty " + ctx.getKty() + " not supported by this factory"); }

try { return factory.createJwk(ctx); }
catch (IllegalArgumentException e) { return dispatchToCorrectFactory(ctx); }

When it happens

Trigger: Directly instantiating a concrete family JwkFactory and calling createJwk with a context whose key type ('kty') does not match the factory (e.g. passing an RSA context to an EC factory), or a null-keyed context of the wrong type.

Common situations: Custom JWK factory pipelines; unit tests calling factories directly instead of through Jwks.builder(); custom JwkFactory implementations delegating incorrectly.

Understand the failure class

Background: "Must be a positive integer", "Invalid value", "Unsupported": the invalid-argument-value error family, when a library rejects the value you pass — this error's family across 35 libraries.

Related errors

• ${message}
• Unrecognized JWA EC curve id '${jwaCurveId}'
• Unable to create ${type.getSimpleName()} from JWK ${ctx}: ${
• JWKs are immutable and may not be modified.
• A ${Key.class.getName()} or one or more name/value pairs mus

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/5d4cefee290d1ffa. Report an issue: GitHub.