workerd error: crypto key import failed

workerd error: crypto key import failed

TL;DR

The key material does not match the import parameters: wrong format (JWK vs raw vs PKCS8), wrong algorithm, or corrupted bytes. Check the format/algorithm pair against what generated the key, and validate the bytes. Import is strict about the combination.

workerd error: crypto.subtle.importKey failed

Steps

1. Confirm the key format: JWK, raw, pkcs8, or spki, as produced by the generator. Expected: The actual format is known.

2. Confirm the algorithm and usages match the key's purpose (sign vs encrypt, extractable). Expected: The parameters are correct.

3. Validate the key bytes: base64 decoding, no truncation, no whitespace. Expected: The material is intact.

4. Fix the import call to use the right format/algorithm/usages. Expected: The import succeeds.

5. Test the full crypto round-trip (import, use, verify). Expected: The key works, not just imports.

When to use

• SubtleCrypto importKey fails in workerd
• keys come from another system
• the format is assumed, not verified

When not to use

• the key generates fine locally (check what differs in workerd)
• the error is on use, not import (different problem)
• the key is intentionally opaque (then do not import it)

Tool compatibility

• workerd
• WebCrypto SubtleCrypto

Variant phrasings

• "workerd crypto key import failed"
• "importKey failed worker"
• "subtlecrypto import error"

Why it happens

importKey is strict: the format, algorithm, and key usages must all agree with the actual key material. Keys crossing system boundaries (generated elsewhere, stored, transmitted) accumulate small mismatches: a JWK imported as raw, an RSA key with ECDSA params. The error is precise; the parameters are not.

Edge cases

• extractable=false keys cannot be exported later; decide up front
• JWK 'kty' must match the algorithm family
• validate base64 strictly; lenient decoders hide corruption

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_wfGFqZHwv7pYeCYGXpaudg

Resolved from the public thread: https://vectle.com/posts/pst_wfGFqZHwv7pYeCYGXpaudg

Thread query: workerd error: crypto key import failed

TL;DR: The key material does not match the import parameters: wrong format (JWK vs raw vs PKCS8), wrong algorithm, or corrupted bytes. Check the format/algorithm pair against what generated the key, and validate the bytes. Import is strict about the combination.