What causes "Unsupported JWT Content Encryption Algorithm" in nextauthjs/next-auth?

Use a supported enc value, e.g. enc: 'A256GCM' (or 'A128CBC-HS256') in the jwt config.

Unsupported JWT Content Encryption Algorithm

Error message

Unsupported JWT Content Encryption Algorithm

What it means

getDerivedEncryptionKey derives the JWT encryption key from the secret via HKDF, and the key length depends on the configured JWT content-encryption algorithm (enc). If options.enc is set to an algorithm the library does not know how to handle, it throws this generic Error in packages/core/src/jwt.ts:214.

Source

Thrown at packages/core/src/jwt.ts:214

    return null
  }
}

async function getDerivedEncryptionKey(
  enc: string,
  keyMaterial: Parameters<typeof hkdf>[1],
  salt: Parameters<typeof hkdf>[2]
) {
  let length: number
  switch (enc) {
    case "A256CBC-HS512":
      length = 64
      break
    case "A256GCM":
      length = 32
      break
    default:
      throw new Error("Unsupported JWT Content Encryption Algorithm")
  }
  return await hkdf(
    "sha256",
    keyMaterial,
    salt,
    `Auth.js Generated Encryption Key (${salt})`,
    length
  )
}

export interface DefaultJWT extends Record<string, unknown> {
  name?: string | null
  email?: string | null
  picture?: string | null
  sub?: string
  iat?: number
  exp?: number
  jti?: string

View on GitHub (pinned to a1a16a5a77)

Solutions

Use a supported enc value, e.g. enc: 'A256GCM' (or 'A128CBC-HS256') in the jwt config.
Check the exact spelling/case of the enc option in your auth config.
If you do not need custom encryption, remove the jwt.enc option and use the defaults.

Example fix

// before
jwt: { encryption: true, enc: 'AES256GCM' }
// after
jwt: { encryption: true, alg: 'dir', enc: 'A256GCM' }

Defensive patterns

Strategy: validation

Validate before calling

const SUPPORTED_ENC = ['A128CBC-HS256', 'A256GCM', 'A192GCM', 'A128GCM']
if (config.jwt?.enc && !SUPPORTED_ENC.includes(config.jwt.enc)) {
  throw new Error(`Unsupported JWT enc: ${config.jwt.enc}`)
}

Try / catch

try {
  const session = await auth()
} catch (e) {
  if ((e as Error).message.includes('Unsupported JWT Content Encryption Algorithm')) {
    // reset jwt config to defaults
  }
}

Prevention

Stick to documented enc values (e.g. 'A256GCM') or omit the option entirely.
Add a config unit test that constructs Auth with your jwt options.
Copy JWT encryption presets only from the official Auth.js docs.

When it happens

Trigger: Setting jwt: { encryption: true, alg: ..., enc: ... } in the Auth config with an enc value outside the supported list (A128CBC-HS256, A256GCM, etc. — only specific enc values map to HKDF output lengths).

Common situations: Copy-pasting JWT encryption config from blog posts or other libraries; typos in the enc string (e.g. 'A256GCM ' with whitespace or 'AES256GCM'); upgrading Auth.js and keeping an enc value from an older/unsupported preset.

Related errors

AI-assisted analysis of nextauthjs/next-auth@a1a16a5a77 (2026-08-28). Data as JSON: /api/errors/5a8b0752f404f392. Report an issue: GitHub.