ory/hydra · error · jwk.ErrUnsupportedKeyAlgorithm

unsupported key algorithm: %s

Error message

unsupported key algorithm: %s

What it means

GenerateAndPersistKeySet wraps jwk.ErrUnsupportedKeyAlgorithm when jwk.GenerateJWK rejects the algorithm string supplied for the key set. The library only supports a fixed set of JOSE signature algorithms (e.g. RS256, ES256, HS256, EdDSA); anything else — an empty/typo'd alg or a deprecated/unsupported one — produces "unsupported key algorithm: %s". This error originates in ory/x jwk, not the database layer.

Source

Thrown at persistence/sql/persister_jwk.go:47

	}
}

// GenerateAndPersistKeySet implements jwk.Manager.
func (p *JWKPersister) GenerateAndPersistKeySet(ctx context.Context, set, kid, alg, use string) (_ *jose.JSONWebKeySet, err error) {
	ctx, span := p.D.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.GenerateAndPersistKeySet",
		trace.WithAttributes(
			attribute.String("set", set),
			attribute.String("kid", kid),
			attribute.String("alg", alg)))
	defer otelx.End(span, &err)

	if kid == "" {
		kid = uuid.Must(uuid.NewV4()).String()
	}

	keys, err := jwk.GenerateJWK(jose.SignatureAlgorithm(alg), kid, use)
	if err != nil {
		return nil, errors.Wrapf(jwk.ErrUnsupportedKeyAlgorithm, "%s", err)
	}

	err = p.AddKeySet(ctx, set, keys)
	if err != nil {
		return nil, err
	}

	return keys, nil
}

// AddKey implements jwk.Manager.
func (p *JWKPersister) AddKey(ctx context.Context, set string, key *jose.JSONWebKey) (err error) {
	ctx, span := p.D.Tracer(ctx).Tracer().Start(ctx, "persistence.sql.AddKey",
		trace.WithAttributes(
			attribute.String("set", set),
			attribute.String("kid", key.KeyID)))
	defer otelx.End(span, &err)

View on GitHub (pinned to 4174065ffb)

Solutions

1. Use a supported algorithm, e.g. RS256, ES256, HS256 or EdDSA, matching case exactly.
2. Check the jwk.SupportedAlgorithms / GenerateJWK source for the exact allow-list in your version.
3. If config (strategies / key generator settings) references the algorithm, correct the identifier there.
4. For ECDSA keys ensure the full name like ES256 rather than a generic family name.

Example fix

// before
curl -X PUT .../admin/keys/my-set --data '{"alg":"RS512","use":"sig"}'
// after
curl -X PUT .../admin/keys/my-set --data '{"alg":"RS256","use":"sig"}'

alg := "RS256" // must be one of RS256, ES256, HS256, EdDSA (see jwk.GenerateJWK)
if !slices.Contains([]string{"RS256", "ES256", "HS256", "EdDSA"}, alg) {
    return fmt.Errorf("unsupported key algorithm: %s", alg)
}

When it happens

Trigger: Calling the JWK generation/admin API (PUT /admin/keys/{set}) or GenerateAndPersistKeySet with alg values like RS512, PS256 (unsupported builds), "rsa", "" or a misspelled name; config mis-defining key generators for the OAuth2 signer.

Common situations: Copy-pasting alg names from other stacks ("HS512" with wrong case, "ECDSA"), driving the CLI hydra keys create with a wrong --alg flag, upgrading versions where support for an algorithm was dropped.

Related errors

• invalid JWK key
• unknown algorithm %s for signing key
• unknown algorithm %s for encryption key
• invalid elliptic curve key size, this algorithm does not sup
• invalid key size for RSA key, 2048 or more is required

AI-assisted analysis of ory/hydra@4174065ffb (2026-09-03). Data as JSON: /api/errors/ef8912473a0e5da3. Report an issue: GitHub.