ory/hydra · error

ErrUnsupportedKeyAlgorithm

ErrUnsupportedKeyAlgorithm

Error message

%s

What it means

GenerateJWK builds a JSON Web Key for the requested signing algorithm. When josex.NewSigningKey cannot construct a private key for the given jose.SignatureAlgorithm (e.g. an algorithm that is not an RSA/ECDSA/EdDSA signing algorithm supported by the jose library), the error is wrapped as ErrUnsupportedKeyAlgorithm with the underlying message. It signals the caller passed an unsupported or non-signing algorithm, not a key-size problem.

Source

Thrown at jwk/generate.go:24

import (
	"crypto/x509"

	"github.com/go-jose/go-jose/v3"
	"github.com/gofrs/uuid"
	"github.com/pkg/errors"

	"github.com/ory/x/josex"
)

func GenerateJWK(alg jose.SignatureAlgorithm, kid, use string) (*jose.JSONWebKeySet, error) {
	bits := 0
	if alg == jose.RS256 || alg == jose.RS384 || alg == jose.RS512 {
		bits = 4096
	}

	_, priv, err := josex.NewSigningKey(alg, bits)
	if err != nil {
		return nil, errors.Wrapf(ErrUnsupportedKeyAlgorithm, "%s", err)
	}

	if len(kid) == 0 {
		kid = uuid.Must(uuid.NewV4()).String()
	}

	if len(use) == 0 {
		use = "sig"
	}

	return &jose.JSONWebKeySet{
		Keys: []jose.JSONWebKey{
			{
				Algorithm:                   string(alg),
				Key:                         priv,
				Use:                         use,
				KeyID:                       kid,
				Certificates:                []*x509.Certificate{},

View on GitHub (pinned to 4174065ffb)

Solutions

1. Check the alg argument passed to GenerateJWK and use a supported signing algorithm (RS256/RS384/RS512, ES256/ES384/ES512, or EdDSA as supported by josex.NewSigningKey)
2. Fix the configuration value feeding the algorithm (e.g. hydra.strategies.jwt.jwks.algorithm or the key generation CLI flag) to a valid signing algorithm
3. Verify you are not passing a JWS 'alg' that maps to HMAC (HS*) — HMAC keys cannot be generated as JWK signing keys here
4. If upgrading, consult the jose library's supported algorithms for jwk.FromMap/NewSigningKey

Example fix

// before
key, err := jwk.GenerateJWK(context.Background(), jose.HS256, "my-set")
// after
key, err := jwk.GenerateJWK(context.Background(), jose.RS256, "my-set")

func validAlg(alg jose.SignatureAlgorithm) bool {
    switch alg {
    case jose.RS256, jose.RS384, jose.RS512, jose.ES256, jose.ES384, jose.ES512, jose.EdDSA:
        return true
    }
    return false
}
if !validAlg(alg) { return fmt.Errorf("algorithm %s unsupported for JWK generation", alg) }

When it happens

Trigger: Calling jwk.GenerateJWK with an algorithm other than RS256/RS384/RS512/ES256/ES384/ES512/EdDSA-style signing algorithms that josex.NewSigningKey supports, such as HS256 (HMAC is not an asymmetric signing key) or an empty/invalid algorithm string.

Common situations: Configuring Hydra JWK generation with an algorithm read from config that defaults to or was misconfigured as HS256; passing a jose* constant that is an encryption algorithm (e.g. RSA-OAEP) instead of a signing algorithm; upgrading the library where a previously accepted algorithm was removed.

Related errors

• priv/pub JWK key mismatch
• unknown algorithm %s for signing key
• unknown algorithm %s for encryption key
• unsupported key algorithm: %s
• cookiex: at least one secret is required

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/dce9f8df0bff1a15. Report an issue: GitHub.