The JWKS endpoint did not contain any signing keys

jwks-rsa (Node.js) — JwksError from getSigningKey()

What it means

The JWKS endpoint answered with keys, but after filtering none of them can verify signatures. jwks-rsa keeps only keys whose `use` is `"sig"` or absent, whose `kty` is RSA, EC or OKP, and that import successfully as public keys. Everything else — encryption keys, symmetric keys, malformed or private JWKs — is dropped. The sibling message "did not contain any keys" means the `keys` array itself was empty or missing.

Why it happens

• Only encryption keys are published

  common

  Some providers expose separate endpoints for encryption keys (for JWE) and signing keys. Configuring the encryption-key URL yields keys marked `use: "enc"`, which must never verify signatures.

• Symmetric or unknown key types

  occasional

  A set of `kty: "oct"` keys (HMAC secrets — which should never be published) or key types jwks-rsa does not handle is filtered out entirely.

• Private or malformed JWKs

  occasional

  Keys that fail to import (missing `n`/`e`, bad base64url, unsupported curve) are skipped silently, and so are keys that import as private keys because they include `d`. A published private key is also a key-compromise incident.

• The URL returns some other JSON

  occasional

  An OpenID discovery document or an error object has no `keys` array; jwks-rsa then reports that the endpoint contained no keys at all.

How to fix it

1. 1.

   Look at kty, use and alg of every key

   One line of jq shows why each key is filtered. A `has_private: true` row means the key set leaks a private key: remove it and rotate that key.

   curl -s "$JWKS_URI" | jq '.keys[] | {kid, kty, use, alg, crv, has_private: has("d")}'

2. 2.

   Publish at least one signing key

   If you operate the endpoint, include each active signing key with `use: "sig"`, a unique `kid` and its `alg`. Encryption keys may live in the same set as long as they are marked `use: "enc"`.

   {
     "keys": [
       { "kty": "RSA", "kid": "sig-2026-10", "use": "sig", "alg": "RS256", "n": "…", "e": "AQAB" },
       { "kty": "RSA", "kid": "enc-2026", "use": "enc", "alg": "RSA-OAEP-256", "n": "…", "e": "AQAB" }
     ]
   }

← Browse the full signature error database