How to fix Error: Invalid key format (private key not in expected format) in Node.js

const crypto = require('crypto');
const fs = require('fs');

// Read the key file
const keyData = fs.readFileSync('private-key.pem', 'utf8');

// Check for proper PEM structure
console.log('Key preview:', keyData.substring(0, 50));

// Valid PKCS#8 should start with:
// -----BEGIN PRIVATE KEY-----

// Valid PKCS#1 should start with:
// -----BEGIN RSA PRIVATE KEY-----

// Valid EC key should start with:
// -----BEGIN EC PRIVATE KEY-----

// Option 1: Replace escaped newlines
const privateKey = process.env.PRIVATE_KEY.replace(/\\n/g, '\n');

// Option 2: Use Buffer with base64 encoding
// Store in .env as base64: PRIVATE_KEY_B64=<base64-encoded-key>
const privateKey = Buffer.from(
  process.env.PRIVATE_KEY_B64,
  'base64'
).toString('utf8');

// Then use with crypto
const keyObject = crypto.createPrivateKey({
  key: privateKey,
  format: 'pem',
});

const crypto = require('crypto');
const fs = require('fs');

// For DER-encoded keys
const derKey = fs.readFileSync('private-key.der');
const keyObject = crypto.createPrivateKey({
  key: derKey,
  format: 'der',
  type: 'pkcs8',  // or 'pkcs1' or 'sec1'
});

// For encrypted PEM keys
const encryptedPem = fs.readFileSync('encrypted-key.pem', 'utf8');
const keyObject = crypto.createPrivateKey({
  key: encryptedPem,
  format: 'pem',
  type: 'pkcs8',
  passphrase: 'your-passphrase-here',
});

# Using OpenSSL to convert PKCS#1 to PKCS#8
openssl pkcs8 -topk8 -inform PEM -outform PEM \
  -in pkcs1-key.pem \
  -out pkcs8-key.pem \
  -nocrypt

const crypto = require('crypto');
const fs = require('fs');

const pkcs8Key = fs.readFileSync('pkcs8-key.pem', 'utf8');
const keyObject = crypto.createPrivateKey(pkcs8Key);
// Format 'pem' and type 'pkcs8' are automatically detected

const crypto = require('crypto');

// WRONG - passing JWK as string
const jwkString = '{"kty":"RSA","n":"...","e":"...","d":"..."}';
// This will fail with invalid format error

// CORRECT - parse to object first
const jwkObject = JSON.parse(jwkString);
const keyObject = crypto.createPrivateKey({
  key: jwkObject,
  format: 'jwk',
});

// Or directly with object literal
const keyObject2 = crypto.createPrivateKey({
  key: {
    kty: 'RSA',
    n: 'base64url-encoded-modulus',
    e: 'AQAB',
    d: 'base64url-encoded-private-exponent',
    // ... other JWK parameters
  },
  format: 'jwk',
});

const crypto = require('crypto');
const fs = require('fs');

function loadPrivateKey(filepath) {
  try {
    const keyData = fs.readFileSync(filepath, 'utf8');

    // Trim whitespace
    const trimmedKey = keyData.trim();

    // Validate PEM boundaries
    if (!trimmedKey.includes('-----BEGIN') || !trimmedKey.includes('-----END')) {
      throw new Error('Invalid PEM format: missing boundaries');
    }

    // Try to create key object
    const keyObject = crypto.createPrivateKey(trimmedKey);

    console.log('Private key loaded successfully');
    return keyObject;

  } catch (error) {
    console.error('Failed to load private key:', error.message);
    console.error('Key file path:', filepath);

    if (error.message.includes('Invalid key format')) {
      console.error('Hint: Check PEM headers, newlines, and encoding');
    }

    throw error;
  }
}

// Usage
const key = loadPrivateKey('./private-key.pem');