# How to forge an RS256 token with the Signing Key

**URL:** <https://community.auth0.com/t/how-to-forge-an-rs256-token-with-the-signing-key/108925>\
**Category:** Get Help\
**Tags:** other, test\
**Created:** [June 8, 2023, 11:31pm UTC](https://community.auth0.com/t/how-to-forge-an-rs256-token-with-the-signing-key/108925 "2023-06-08T23:31:21Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![kuhrt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kuhrt/32/47939_2.png) [@kuhrt](https://community.auth0.com/u/kuhrt)\
**Post date:** [June 8, 2023, 11:31pm UTC](https://community.auth0.com/t/how-to-forge-an-rs256-token-with-the-signing-key/108925/1 "2023-06-08T23:31:21Z")

</div>

I am trying to create a token with the signing key. However I get an error about the key and algorithm.

 ![image](https://global.discourse-cdn.com/auth0/original/3X/b/8/b84d3242056d91439cc6d81336b9de308631c199.png)

```auto
secretOrPrivateKey must be an asymmetric key when using RS256

```

Is there something obvious I’m doing wrong?

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [June 9, 2023, 12:16am UTC](https://community.auth0.com/t/how-to-forge-an-rs256-token-with-the-signing-key/108925/3 "2023-06-09T00:16:21Z")

</div>

Hey there @kuhrt welcome to the community!

I assume the key you’ve added here comes from your tenant settings? If so, this is not your tenant’s private signing key and thus won’t work in this scenario. What you’re using here is actually a X.509 certificate which is a different format than what is expected (.pem) and includes your tenants public key as well as other certificate values (issuer, validity dates, etc.). In fact, the RS256 signing key is protected and used by Auth0 to sign tokens and **not available**.

If you would like to sign tokens yourself, you’ll instead need to generate your own RSA key pair using something like [openssl](https://www.openssl.org/docs/). For example, the following will generate the private key:

```auto
openssl genpkey -algorithm RSA -out private_key.pem -pkeyopt rsa_keygen_bits:2048

```

And extract the public key from the private key:

```auto
openssl rsa -pubout -in private_key.pem -out public_key.pem

```

Using the `private_key.pem` as your secret in the code you shared should work.

Hope this helps!

---

<div class="post-metadata">

**Author:** ![kuhrt](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/kuhrt/32/47939_2.png) [@kuhrt](https://community.auth0.com/u/kuhrt)\
**Post date:** [June 9, 2023, 12:32am UTC](https://community.auth0.com/t/how-to-forge-an-rs256-token-with-the-signing-key/108925/4 "2023-06-09T00:32:22Z")

</div>

Yep it is.

If we do what you’re saying, how are we going to validate our tokens with the Auth0 JWKS?

These tokens need to be sent to our app and validated with our tenant JWKS.

It sounds like it’s impossible. This is a problem for us.

---

<div class="post-metadata">

**Author:** ![ty.frith](https://sea1.discourse-cdn.com/auth0/user_avatar/community.auth0.com/ty.frith/32/58484_2.png) [@ty.frith](https://community.auth0.com/u/ty.frith)\
**Post date:** [June 9, 2023, 4:23pm UTC](https://community.auth0.com/t/how-to-forge-an-rs256-token-with-the-signing-key/108925/5 "2023-06-09T16:23:28Z")

</div>

Thanks for confirming!

> [@kuhrt](#):
>
> If we do what you’re saying, how are we going to validate our tokens with the Auth0 JWKS?

If you’re signing tokens in this manner then you won’t be able to validate using your tenants JWKS.

> [@kuhrt](#):
>
> These tokens need to be sent to our app and validated with our tenant JWKS.
> 
> It sounds like it’s impossible. This is a problem for us.

Is there a reason you can’t get tokens from Auth0? This is the typical approach. You will then be able to validate them using your tenants JWKS.

---

<div class="post-metadata">

**Author:** ![system](https://global.discourse-cdn.com/auth0/original/3X/b/5/b560f266932fcce5d57f09a6595bd50518cae3f3.jpeg) [@system](https://community.auth0.com/u/system)\
**Post date:** [June 30, 2023, 11:30pm UTC](https://community.auth0.com/t/how-to-forge-an-rs256-token-with-the-signing-key/108925/6 "2023-06-30T23:30:46Z")

</div>

This topic was automatically closed 14 days after the last reply. New replies are no longer allowed.