ory/hydra · error

jwksx: available algorithms are "%+v" but unknown algorithm

Error message

jwksx: available algorithms are "%+v" but unknown algorithm was requested: "%s"

What it means

Returned by jwksx generate when the requested signing algorithm is not in the handled set (ES256/384/512, EdDSA, RS*/PS*, HS*). The algorithm string in the key-generation request is unsupported — typically a typo or a JWE-only algorithm passed for signing.

Source

Thrown at oryx/jwksx/generator.go:127

		return key, errors.Wrapf(err, "jwks: unable to generate key")
	case jose.EdDSA:
		_, key, err := ed25519.GenerateKey(rand.Reader)
		return key, errors.Wrapf(err, "jwks: unable to generate key")
	case jose.RS256, jose.RS384, jose.RS512, jose.PS256, jose.PS384, jose.PS512:
		key, err := rsa.GenerateKey(rand.Reader, bits)
		return key, errors.Wrapf(err, "jwks: unable to generate key")
	case jose.HS256, jose.HS384, jose.HS512:
		if bits%8 != 0 {
			return nil, errors.Errorf(`jwksx: key size must be a multiple of 8 for algorithm "%s" but got: %d`, alg, bits)
		}

		key := make([]byte, bits/8)
		if _, err := io.ReadFull(rand.Reader, key); err != nil {
			return nil, errors.Wrapf(err, "jwks: unable to generate key")
		}
		return key, nil
	default:
		return nil, errors.Errorf(`jwksx: available algorithms are "%+v" but unknown algorithm was requested: "%s"`, GenerateSigningKeysAvailableAlgorithms(), alg)
	}
}

View on GitHub (pinned to 4174065ffb)

Solutions

  1. Use one of the supported algorithms listed in the error message
  2. Check for typos in the configured algorithm name (e.g. RS25 6 vs RS256)
  3. Ensure a signing algorithm, not an encryption algorithm, was requested
Defensive patterns

Strategy: validation

When it happens

Trigger: Thrown at oryx/jwksx/generator.go:127 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/3b740233c8abd789. Report an issue: GitHub.