sign/verify accepts any type as the key
Author: na-trium-144Created Sep 23, 2026Updated Sep 24, 2026
Labelstriage
What version of Hono are you using?
4.13.8
What runtime/platform is your app running on? (with version if possible)
Node.js
What steps can reproduce the bug?
In utils/jwt, the second argument of the sign() and verify() functions is of type SignatureKey, which is defined as follows:
export interface HonoJsonWebKey extends JsonWebKey {
kid?: string;
}
export type SignatureKey = string | HonoJsonWebKey | CryptoKey;It accepts any object type.
I accidentally wrote code that passed a Promise<CryptoKey> without await, but this did not result in a type error, and caused a runtime error.
What is the expected behavior?
I would like objects that are clearly not keys (such as a Promise) to trigger a type error.
What do you see instead?
It accepts any object type and causes a runtime error.
Additional information
No response
Source: honojs/hono