See also Algorithm Selection Guide.

What are the key/secret requirements for JOSE algorithms

JWS "alg"

The following table describes the requirements for a key/secret for the supported JWS Algorithms ("alg").

With asymmetric algorithms, the private key is used for signing, the public key is used for verification.

Note that JWK parameters such as "use", "alg", or "key_ops" may further restrict the use of a given key.

JWE "alg"

The following table describes the requirements for a key/secret for the supported JWE Key Management Algorithms ("alg")

With asymmetric algorithms, the recipient's public key is used for encryption, the private key is used for decryption.

Note that JWK parameters such as "use", "alg", or "key_ops" may further restrict the use of a given key.

JWE "enc"

The following table describes the requirements for a secret for the supported JWE Content Encryption Algorithms ("enc") used in Direct Encryption Mode ("alg": "dir")

Note that JWK parameters such as "use", "alg", or "key_ops" may further restrict the use of a given key.

Key argument type notes

• CryptoKey is a representation of a key/secret available in all supported runtimes.
• KeyObject is a representation of a key/secret available in the Node.js runtime.
• Uint8Array is a typed array representing an array of 8-bit unsigned integers.
• JSON Web Key is a JavaScript Object Notation (JSON) data structure that represents a cryptographic key. It is defined in RFC7517
• In Node.js the Buffer class is a subclass of Uint8Array and so Buffer can be provided for secrets as well.
• Key Import Functions can be used to import PEM or JWK formatted asymmetric keys and certificates to the supported key input representations.

Supported Runtimes

Not all algorithms are available in all runtimes, see the issues linked below for details.

• Bun
• Browsers
• Cloudflare Workers
• Deno
• Electron
• Node.js
• Vercel's Edge Runtime