paperclipai/paperclip · error

Cloud runtime identity signing key is invalid

Error message

Cloud runtime identity signing key is invalid

What it means

Same function and conditions as error 614 (JWKS entry not a valid Ed25519 sig public key), surfaced here as its own indexed throw site at line 255. Any deviation in kty/crv/use/alg, a missing x, or presence of the private d field on the matched JWK produces this message.

Source

Thrown at server/src/services/cloud-runtime-identity.ts:255

  let parsed: unknown;
  try {
    parsed = JSON.parse(raw);
  } catch {
    throw new Error("PAPERCLIP_CLOUD_RUNTIME_IDENTITY_JWKS is invalid");
  }
  const keys = parsed && typeof parsed === "object" && !Array.isArray(parsed)
    ? (parsed as { keys?: unknown }).keys
    : undefined;
  if (!Array.isArray(keys)) throw new Error("PAPERCLIP_CLOUD_RUNTIME_IDENTITY_JWKS is invalid");
  const matches = keys.filter((candidate): candidate is JsonWebKey & { kid: string } => {
    if (!candidate || typeof candidate !== "object" || Array.isArray(candidate)) return false;
    const key = candidate as JsonWebKey & { kid?: unknown };
    return key.kid === kid;
  });
  if (matches.length !== 1) throw new Error("Cloud runtime identity uses an unknown signing key");
  const jwk = matches[0];
  if (jwk.kty !== "OKP" || jwk.crv !== "Ed25519" || jwk.use !== "sig" || jwk.alg !== "EdDSA" || !jwk.x || jwk.d) {
    throw new Error("Cloud runtime identity signing key is invalid");
  }
  return createPublicKey({ key: jwk, format: "jwk" });
}

function verifyClaims(input: {
  compactJws: string;
  env: NodeJS.ProcessEnv;
  now: Date;
}): RuntimeIdentityClaims {
  const parts = input.compactJws.split(".");
  if (parts.length !== 3 || parts.some((part) => part.length === 0)) {
    throw new Error("Cloud runtime identity assertion is not a compact JWS");
  }
  const [encodedHeader, encodedPayload, encodedSignature] = parts;
  const header = decodeJsonPart(encodedHeader, "protected header");
  if (
    header.alg !== "EdDSA"
    || header.typ !== CLOUD_RUNTIME_IDENTITY_JWS_TYPE

View on GitHub (pinned to 01ad858492)

Solutions

1. Use the canonical public JWKS from the Cloud control plane verbatim
2. Strip any private component (d) and add use:"sig" and alg:"EdDSA" to the JWK
3. Validate the JWK locally with createPublicKey({key:jwk,format:'jwk'}) before deploying it
4. Rotate to a freshly generated Ed25519 keypair if the existing key material is wrong type

Example fix

// before
jwk.use === undefined // omitted
// after
{"kty":"OKP","crv":"Ed25519","use":"sig","alg":"EdDSA","kid":"k1","x":"<base64url>"}

// same guard as 614 — run it against every JWKS entry at startup
const ok = (JSON.parse(jwks) as { keys: unknown[] }).keys.every(k =>
  typeof k === "object" && k !== null && (k as any).kty === "OKP" && (k as any).crv === "Ed25519"
  && (k as any).use === "sig" && (k as any).alg === "EdDSA" && typeof (k as any).x === "string" && !("d" in (k as any)));

try {
  verifyCloudRuntimeIdentityAssertion({ compactJws: assertion, expectedPreviousOrigin: prev });
} catch (e) {
  if (String((e as Error).message).includes("signing key is invalid")) {
    logger.error("Rejecting identity assertion: JWKS key material does not meet Ed25519 sig requirements", { error: e });
  } else throw e;
}

When it happens

Trigger: Identical to error 614: matched JWK fails the strict check jwk.kty === 'OKP' && jwk.crv === 'Ed25519' && jwk.use === 'sig' && jwk.alg === 'EdDSA' && !!jwk.x && !jwk.d.

Common situations: Identical to error 614: wrong key type in JWKS, leaked private key material in the env var, missing use/alg metadata after hand-editing or transformation of the JWKS.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• Cloud runtime identity uses an unknown signing key
• Cloud runtime identity signature is invalid
• Access denied
• [plugin-kubernetes] egressMode=standard cannot enforce FQDN-
• UI parser path escapes package directory — skipping

AI-assisted analysis of paperclipai/paperclip@01ad858492 (2026-09-10). Data as JSON: /api/errors/9a18417862e5cbaf. Report an issue: GitHub.