Skip to content

Signing key hex assumption can crash with non-hex keys #1

@jmarbutt

Description

@jmarbutt

Problem

The out-of-band registration code assumes the signing key suffix is hex-encoded and calls Convert.FromHexString(). Any non-hex signing key will throw a FormatException before registration completes.

Location: Inngest/InngestClient.cs:942-955

var keyBytes = Convert.FromHexString(normalizedKey);  // Throws if not valid hex

Expected Behavior

The SDK should either:

  1. Handle non-hex keys gracefully (encode as UTF-8 bytes instead)
  2. Validate the key format and return a clear error (401/500) instead of throwing

SDK Spec Reference

The spec only requires hashing the key bytes - it doesn't mandate hex encoding. We should verify what format Inngest actually sends keys in.

Priority

High - this could crash production applications during registration.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions