I’m working on a Laravel project and trying to implement JWT authentication using the php-open-source-saver/jwt-auth package and I’m having an issue when attempting to generate a token.

my JWT_ALGO=HS256

The error message I’m receiving is:

PHPOpenSourceSaverJWTAuthExceptionsJWTException:
Could not create token: Key provided is shorter than 256 bits, only 224 bits provided

below is the code

  try {
            $notActivated = $this->auth->login($credentials);

            if ($notActivated === trans('user::users.account not validated')) {
                return response()->json(
                    [
                        'success' => false,
                        'message' => trans('user::users.account not validated'),
                    ],
                    403
                );
            }
            if (!$token = auth('api')->attempt($credentials)) {
                // attempt to verify the credentials and create a token for the user
                return response()->json(
                    [
                        'success' => false,
                        'message' => trans('invalid credentials'),
                    ],
                    401
                );
            }
        }

below is the stack trace for reference:

PHPOpenSourceSaverJWTAuthExceptionsJWTException {#969
#message: "Could not create token: Key provided is shorter than 256 bits, only 224 bits provided"
#code: 0
#file: "Project/vendor/php-open-source-saver/jwt-auth/src/Providers/JWT/Lcobucci.php"
#line: 143
-previous: LcobucciJWTSignerInvalidKeyProvided {#968
#message: "Key provided is shorter than 256 bits, only 224 bits provided"
#code: 0
#file: "Project/vendor/lcobucci/jwt/src/Signer/InvalidKeyProvided.php"
#line: 39
trace: {
Project/vendor/lcobucci/jwt/src/Signer/InvalidKeyProvided.php:39 {
LcobucciJWTSignerInvalidKeyProvided::tooShort(int $expectedLength, int $actualLength): self …
› {
› return new self('Key provided is shorter than ' . $expectedLength . ' bits, only ' . $actualLength . ' bits provided');
}
Project/vendor/lcobucci/jwt/src/Signer/Hmac.php:20 {
LcobucciJWTSignerHmac->sign(string $payload, Key $key): string …
› if ($actualKeyLength < $expectedKeyLength) {
› throw InvalidKeyProvided::tooShort($expectedKeyLength, $actualKeyLength);
› }
}
Project/vendor/lcobucci/jwt/src/Token/Builder.php:119 {
LcobucciJWTTokenBuilder->getToken(Signer $signer, Key $key): Plain …
›
› $signature = $signer->sign($encodedHeaders . '.' . $encodedClaims, $key);
› $encodedSignature = $this->encoder->base64UrlEncode($signature);
}
Project/vendor/php-open-source-saver/jwt-auth/src/Providers/JWT/Lcobucci.php:141 {
PHPOpenSourceSaverJWTAuthProvidersJWTLcobucci->encode(array $payload) …
›
› return $this->builder->getToken($this->config->signer(), $this->config->signingKey())->toString();
› } catch (Exception $e) {
}
Project/vendor/php-open-source-saver/jwt-auth/src/Manager.php:85 {
PHPOpenSourceSaverJWTAuthManager->encode(Payload $payload) …
› {
› $token = $this->provider->encode($payload->get());
›
}
Project/vendor/php-open-source-saver/jwt-auth/src/JWT.php:74 {
PHPOpenSourceSaverJWTAuthJWT->fromSubject(JWTSubject $subject) …
›
› return $this->manager->encode($payload)->get();
› }
}
Project/vendor/php-open-source-saver/jwt-auth/src/JWT.php:84 {
PHPOpenSourceSaverJWTAuthJWT->fromUser(JWTSubject $user) …
› {
› return $this->fromSubject($user);
› }
}
Project/vendor/php-open-source-saver/jwt-auth/src/JWTGuard.php:164 {
PHPOpenSourceSaverJWTAuthJWTGuard->login(JWTSubject $user) …
› {
› $token = $this->jwt->fromUser($user);
› $this->setToken($token)->setUser($user);
}
Project/vendor/php-open-source-saver/jwt-auth/src/JWTGuard.php:149 {
PHPOpenSourceSaverJWTAuthJWTGuard->attempt(array $credentials = [], $login = true) …
› if ($this->hasValidCredentials($user, $credentials)) {
› return $login ? $this->login($user) : true;
› }
}
Project/Modules/User/Http/Controllers/Api/AuthController.php:85 {
ModulesUserHttpControllersApiAuthController->postLogin(ApiLoginRequest $request): JsonResponse …
› }
› if (!$token = auth('api')->attempt($credentials)) {
› // attempt to verify the credentials and create a token for the user
}

Things I have tried:

• Cleared Cache
• Cleared the JWT keys
• Regenerated the JWT keys using jwt:generate-certs
• Generated a new key manually

This same code works perfectly in another project with same app key and I tried copying the working version to this project, but I’m still getting the same error.
I’m unable to figure out why the key is shorter than the required 256 bits when i generate one. Has anyone faced a similar issue or could point me in the right direction to resolve this?

Any help would be greatly appreciated!