#5432·hono

sign/verify accepts any type as the key

Author: na-trium-144Created Sep 23, 2026Updated Sep 24, 2026
Labelstriage

What version of Hono are you using?

4.13.8

What runtime/platform is your app running on? (with version if possible)

Node.js

What steps can reproduce the bug?

In utils/jwt, the second argument of the sign() and verify() functions is of type SignatureKey, which is defined as follows:

typescript
export interface HonoJsonWebKey extends JsonWebKey {
    kid?: string;
}
export type SignatureKey = string | HonoJsonWebKey | CryptoKey;

It accepts any object type.

I accidentally wrote code that passed a Promise<CryptoKey> without await, but this did not result in a type error, and caused a runtime error.

What is the expected behavior?

I would like objects that are clearly not keys (such as a Promise) to trigger a type error.

What do you see instead?

It accepts any object type and causes a runtime error.

Additional information

No response