jwtk/jjwt · error · UnsupportedKeyException

unsupportedKey(key, e)

Error message

unsupportedKey(key, e)

What it means

An UnsupportedKeyException produced by the staticJwk-style key(Key) dispatch in DefaultDynamicJwkBuilder when the supplied key is not a recognized RSA/EC public key and the fallback octetKey() (for SecretKey / AES / octet keys) also fails. The builder tried every known JWK family and could not map the key to one.

Source

Thrown at impl/src/main/java/io/jsonwebtoken/impl/security/DefaultDynamicJwkBuilder.java:98

    }

    private static UnsupportedKeyException unsupportedKey(Key key, Exception e) {
        String msg = "There is no builder that supports specified key [" + KeysBridge.toString(key) + "].";
        return new UnsupportedKeyException(msg, e);
    }

    @SuppressWarnings("unchecked")
    @Override
    public <A extends PublicKey, B extends PrivateKey> PublicJwkBuilder<A, B, ?, ?, ?, ?> key(A key) {
        if (key instanceof RSAPublicKey) {
            return (PublicJwkBuilder<A, B, ?, ?, ?, ?>) key((RSAPublicKey) key);
        } else if (key instanceof ECPublicKey) {
            return (PublicJwkBuilder<A, B, ?, ?, ?, ?>) key((ECPublicKey) key);
        } else {
            try {
                return octetKey(key);
            } catch (Exception e) {
                throw unsupportedKey(key, e);
            }
        }
    }

    @SuppressWarnings("unchecked")
    @Override
    public <A extends PublicKey, B extends PrivateKey> PrivateJwkBuilder<B, A, ?, ?, ?> key(B key) {
        Assert.notNull(key, "Key cannot be null.");
        if (key instanceof RSAPrivateKey) {
            return (PrivateJwkBuilder<B, A, ?, ?, ?>) key((RSAPrivateKey) key);
        } else if (key instanceof ECPrivateKey) {
            return (PrivateJwkBuilder<B, A, ?, ?, ?>) key((ECPrivateKey) key);
        } else {
            try {
                return octetKey(key);
            } catch (Exception e) {
                throw unsupportedKey(key, e);
            }

View on GitHub (pinned to fb71496164)

Solutions

1. Verify the key instance is a supported type: RSAPublicKey, ECPublicKey, or SecretKey; generate keys via jjwt's Jwts.SIG.keyPairBuilder().
2. Register a JCA provider supporting the key type if it is a newer algorithm (e.g. Ed25519 on JDK < 15).
3. Inspect e.getCause() from the UnsupportedKeyException to see why octetKey failed.
4. Catch UnsupportedKeyException around builder calls and surface a clear configuration error.

Example fix

// before
SecretKey k = Keys.secretKeyFor(SignatureAlgorithm.HS256);
PublicJwk jwk = Jwts.builder().key(o.getDsaPublicKey())... // unsupported
// after
KeyPair kp = Jwts.SIG.RS256.keyPair().build();
PublicJwk jwk = Jwts.SIG.RS256.keyPair().build().toPublicJwk();

// only build JWKs from known-supported key types
if (!(key instanceof RSAPublicKey || key instanceof ECPublicKey || key instanceof SecretKey))
    throw new IllegalArgumentException("Unsupported key type: " + key.getClass());

boolean supported = k instanceof RSAPublicKey || k instanceof ECPublicKey || k instanceof SecretKey;

try {
    return Jwts.SIG.keyBuilder().key(key).build();
} catch (UnsupportedKeyException e) {
    throw new CryptoConfigurationException("No JWK family for " + key.getClass().getName(), e);
}

When it happens

Trigger: Calling Jwts.SIG / dynamic JwkBuilder .key(someKey) with a public key that is neither RSA, EC, nor a usable SecretKey — e.g. a custom Key implementation, a DSA/EdDSA key variant unsupported by the installed providers, or a SecretKey whose encoding is unusable.

Common situations: Building JWKs for keys generated by third-party libraries or unusual providers; passing DSA keys; upgraded JDK where an algorithm provider disappeared; mixing jjwt versions that lack support for the key family.

Related errors

• noFamily(key, kty)
• JWT signature does not match locally computed signature. JWT
• The parsed JWT indicates it was signed with the '${algId}' s
• Unsecured JWSs (those with an alg header value of 'none') ar
• PrivateKeys may not be used to verify digital signatures. Pr

AI-assisted analysis of jwtk/jjwt@fb71496164 (2026-09-09). Data as JSON: /api/errors/10d8f9fd7b0b334e. Report an issue: GitHub.