lcobucci/jwt · error · Lcobucci\JWT\Signer\InvalidKeyProvided

The type of the provided key is not

Error message

The type of the provided key is not "{expectedType}", "{actualType}" provided

What it means

Thrown by Rsa::guardAgainstIncompatibleKey when the parsed OpenSSL key's type is not OPENSSL_KEYTYPE_RSA. The RSA signer only accepts RSA keys; presenting an EC, DSA, DH, or unknown key type is rejected with the expected and actual type names.

Solutions

1. Generate an RSA key: `openssl genrsa -out private.pem 2048` and extract `openssl rsa -in private.pem -pubout -out public.pem`
2. Use the matching signer for your key type (Ecdsa signers for EC keys, Rsa signers for RSA keys)
3. Check the mounted key file is the RSA key, not an EC key from a previous setup
4. Confirm with `openssl pkey -in key.pem -text -noout | head` that the key type is RSA

Example fix

// before
$key = InMemory::file('/path/ec-private.pem'); // EC key
$signer = RsaSha256::create();
// after
$key = InMemory::file('/path/rsa-private.pem');
$signer = RsaSha256::create();

$details = openssl_pkey_get_details(openssl_pkey_get_private(file_get_contents($pem))); if ($details['type'] !== OPENSSL_KEYTYPE_RSA) { throw new RuntimeException('Expected RSA key'); }

try { $signature = $signer->sign($payload, $key); } catch (\Jose\Component\Signature\Exception\InvalidKeyProvided $e) { /* mismatch between signer algorithm family and key type */ }

When it happens

Trigger: Using an EC (or DSA) private/public key with the RS256/RS384/RS512 RSA signer — typically by passing the wrong file path or an EC-generated key to RsaSha256::create().

Common situations: Config confusion after migrating from ECDSA (ES256) to RSA (RS256) or vice versa, wrong key file mounted in the secret volume, generating keys with `openssl ecparam` instead of `openssl genrsa`.

Understand the failure class

Background: "is not a compatible type" / "cannot merge" errors: when a value's type doesn't match what the library requires — this error's family across 65 libraries.

Related errors

• The type of the provided key is not
• There was an error while creating the signature
• No constraint given.
• Error while encoding to JSON
• The curve of the provided key is not

AI-assisted analysis of lcobucci/jwt@375813049c (2026-09-14). Data as JSON: /api/errors/071903c1640f5c8b. Report an issue: GitHub.

Appendix: source

Thrown at src/Signer/Rsa.php:25

abstract readonly class Rsa extends OpenSSL
{
    private const int MINIMUM_KEY_LENGTH = 2048;

    final public function sign(string $payload, Key $key): string
    {
        return $this->createSignature($key, $payload);
    }

    final public function verify(string $expected, string $payload, Key $key): bool
    {
        return $this->verifySignature($expected, $payload, $key);
    }

    final protected function guardAgainstIncompatibleKey(int $type, int $lengthInBits): void
    {
        if ($type !== OPENSSL_KEYTYPE_RSA) {
            throw InvalidKeyProvided::incompatibleKeyType(
                self::KEY_TYPE_MAP[OPENSSL_KEYTYPE_RSA],
                self::KEY_TYPE_MAP[$type] ?? 'unknown',
            );
        }

        if ($lengthInBits < self::MINIMUM_KEY_LENGTH) {
            throw InvalidKeyProvided::tooShort(self::MINIMUM_KEY_LENGTH, $lengthInBits);
        }
    }
}

View on GitHub (pinned to 375813049c)