usebruno/bruno · error · Error

Private key is required for ${method} signature method

Error message

Private key is required for ${method} signature method

What it means

Thrown by Bruno's OAuth1 signer (defaultHashFunction) when the signature method is one of RSA-SHA1, RSA-SHA256, or RSA-SHA512 but no privateKey was supplied. RSA signing requires the private key to call crypto.createSign(...).sign(privateKey); HMAC and PLAINTEXT methods do not need it.

Source

Thrown at packages/bruno-requests/src/auth/oauth1-request-authorization.ts:186

  return `${percentEncode(consumerSecret)}&${percentEncode(tokenSecret)}`;
}

// Default hash function
function defaultHashFunction(
  baseString: string,
  key: string,
  method: SignatureMethod,
  privateKey?: string
): string {
  switch (method) {
    case 'PLAINTEXT':
      return key;

    case 'RSA-SHA1':
    case 'RSA-SHA256':
    case 'RSA-SHA512': {
      if (!privateKey) {
        throw new Error(`Private key is required for ${method} signature method`);
      }
      const algoMap: Record<string, string> = {
        'RSA-SHA1': 'RSA-SHA1',
        'RSA-SHA256': 'RSA-SHA256',
        'RSA-SHA512': 'RSA-SHA512'
      };
      const signer = crypto.createSign(algoMap[method]);
      signer.update(baseString);
      return signer.sign(privateKey, 'base64');
    }

    case 'HMAC-SHA512':
      return crypto.createHmac('sha512', key).update(baseString).digest('base64');

    case 'HMAC-SHA256':
      return crypto.createHmac('sha256', key).update(baseString).digest('base64');

    case 'HMAC-SHA1':

View on GitHub (pinned to 9bdd81c7bd)

Solutions

1. Supply a valid PEM-encoded RSA private key via the authorizer/request config when using an RSA method.
2. If you do not have an RSA key pair, switch signature_method back to HMAC-SHA1/SHA256/SHA512.
3. Verify the private-key variable is populated in the active environment before signing.

Example fix

// before
const authorizer = createOAuth1Authorizer({
  consumer: { key, secret },
  signature_method: 'RSA-SHA256'
  // private_key missing
});

// after
const authorizer = createOAuth1Authorizer({
  consumer: { key, secret },
  signature_method: 'RSA-SHA256',
  // supply via the request's rsaPrivateKey / config field used by Bruno
});

const RSA_METHODS = new Set(['RSA-SHA1','RSA-SHA256','RSA-SHA512']);
function validateOAuth1(method, privateKey) {
  if (RSA_METHODS.has(method) && (!privateKey || !String(privateKey).trim())) {
    throw new Error('RSA methods require a private key');
  }
}

const hasRsaKeyForMethod = (method, key) => !method.startsWith('RSA-') || (typeof key === 'string' && /-----BEGIN/.test(key));

try { authorizer.authorize(req); }
catch (err) {
  if (/Private key is required/.test(err.message)) {
    // supply the PEM, or fall back to HMAC-SHA1
  } else throw err;
}

When it happens

Trigger: Configuring an OAuth1 authorizer with signature_method: 'RSA-SHA256' but omitting the private_key (or passing it as undefined/empty) on the request or authorizer config.

Common situations: Switched from HMAC-SHA1 to an RSA method without providing the RSA private key; private key stored in a variable that is undefined in the active environment; PEM string was pasted with stripped headers/newlines.

Related errors

• Unsupported OAuth1 signature method: ${method}
• EdgeGrid: accessToken is required
• EdgeGrid: clientToken is required
• EdgeGrid: clientSecret is required
• Invalid token URL: ${requestConfig.url}

AI-assisted analysis of usebruno/bruno@9bdd81c7bd (2026-08-13). Data as JSON: /api/errors/b03944b1899976ae. Report an issue: GitHub.