tymondesigns/jwt-auth · critical · Tymon\JWTAuth\Exceptions\JWTException

The given algorithm could not be found

Error message

The given algorithm could not be found

What it means

Thrown by getSigner() when the configured algorithm string is not a key of the provider's supported signer map: HS256/HS384/HS512, RS256/RS384/RS512, ES256/ES384/ES512 (exact, case-sensitive). Because getSigner() runs in the provider constructor, this fires as soon as the JWT service is resolved from the container - typically on the first authenticated request, not at deploy time.

Source

Thrown at src/Providers/JWT/Lcobucci.php:199

        $config->setValidationConstraints(
            new SignedWith($this->signer, $this->getVerificationKey())
        );

        return $config;
    }

    /**
     * Get the signer instance.
     *
     * @return \Lcobucci\JWT\Signer
     *
     * @throws \Tymon\JWTAuth\Exceptions\JWTException
     */
    protected function getSigner()
    {
        if (! array_key_exists($this->algo, $this->signers)) {
            throw new JWTException('The given algorithm could not be found');
        }

        $signer = $this->signers[$this->algo];

        if (is_subclass_of($signer, Ecdsa::class) && $this->usingV4()) {
            return $signer::create();
        }

        return new $signer();
    }

    /**
     * {@inheritdoc}
     */
    protected function isAsymmetric()
    {
        return is_subclass_of($this->signer, Rsa::class)
            || is_subclass_of($this->signer, Ecdsa::class);

View on GitHub (pinned to 6c70930a92)

Solutions

1. Set JWT_ALGO to one of the nine supported constants, e.g. JWT_ALGO=HS256 or RS256 - uppercase, no spaces
2. Check for typos, lowercase letters, and stray quotes/whitespace in the .env value: exact string match is required
3. Run php artisan config:clear after fixing .env so the cached config picks up the new value
4. If you need RSASSA-PSS or EdDSA, you cannot use this provider - keep the issuer on a supported algorithm or verify those tokens with a separate custom guard

Example fix

# before
JWT_ALGO=hs256   # throws: The given algorithm could not be found

# after
JWT_ALGO=HS256

// Boot-time guard: fail fast at deploy, not on the first authenticated request
use Tymon\JWTAuth\Providers\JWT\Provider;

public function boot(): void
{
    $supported = [
        Provider::ALGO_HS256, Provider::ALGO_HS384, Provider::ALGO_HS512,
        Provider::ALGO_RS256, Provider::ALGO_RS384, Provider::ALGO_RS512,
        Provider::ALGO_ES256, Provider::ALGO_ES384, Provider::ALGO_ES512,
    ];
    if (!in_array(config('jwt.algo'), $supported, true)) {
        throw new RuntimeException('jwt.algo "'.config('jwt.algo').'" is not supported.');
    }
}

function isSupportedJwtAlgo(?string $algo): bool
{
    return in_array($algo, [
        'HS256', 'HS384', 'HS512',
        'RS256', 'RS384', 'RS512',
        'ES256', 'ES384', 'ES512',
    ], true);
}

use Tymon\JWTAuth\Exceptions\JWTException;

try {
    $token = JWTAuth::fromUser($user);
} catch (JWTException $e) {
    // constructor-time failure: algo/keys are misconfigured - surface as 500 config error
    Log::critical('JWT provider misconfigured', ['error' => $e->getMessage()]);
    abort(500, 'auth service is misconfigured');
}

When it happens

Trigger: Setting JWT_ALGO to anything outside the nine supported values: a typo (RS2156, HS254), a lowercase variant (hs256 - the array_key_exists lookup is case-sensitive), or a genuinely unsupported algorithm (PS256, EdDSA, RS1). Resolving auth('api'), JWTAuth facade, or any route behind auth:api middleware then throws JWTException immediately.

Common situations: Copy-pasting an algorithm name from another library's docs (e.g. node jsonwebtoken's PS256), an env value with trailing whitespace or quotes, upgrading from jwt-auth 0.5 where algorithm handling differed, or two apps sharing one .env with different expectations of JWT_ALGO.

Related errors

• Could not create token: {exception message}
• Token Signature could not be verified.
• Private key is not set.
• Secret is not set.
• Public key is not set.

AI-assisted analysis of tymondesigns/jwt-auth@6c70930a92 (2026-08-21). Data as JSON: /api/errors/498a19cbfec477d9. Report an issue: GitHub.