A JWTKit HMAC signing key is registered from a hard-coded string literal (add(hmac: "...", ...)).

Why this matters

HMACKey is ExpressibleByStringLiteral, so the literal becomes the key that signs and verifies every token: committed to source control it is one search away from compromise, letting an attacker forge a token for any user or role (CWE-798). AI-generated Vapor/JWTKit samples inline the secret to make the snippet "just work".

Read the key from the environment or a secret store instead, e.g. add(hmac: HMACKey(from: Environment.get("JWT_KEY")!), digestAlgorithm: .sha256), and rotate the leaked secret out of source control.

import Vapor
import JWTKit

func configureJWT(_ app: Application) async throws {
    // ruleid: auth.swift.jwt.hardcoded-hmac-key
    await app.jwt.keys.add(hmac: "my-super-secret-signing-key", digestAlgorithm: .sha256)

    let keys = JWTKeyCollection()
    // ruleid: auth.swift.jwt.hardcoded-hmac-key
    await keys.add(hmac: "another-inline-secret", digestAlgorithm: .sha256, kid: "v1")
}

import Vapor
import JWTKit

func configureJWT(_ app: Application) async throws {
    // Key comes from the environment, not a literal.
    await app.jwt.keys.add(hmac: HMACKey(from: Environment.get("JWT_KEY")!), digestAlgorithm: .sha256)

    let keys = JWTKeyCollection()
    let key = HMACKey(from: Environment.get("SIGNING_KEY")!)
    await keys.add(hmac: key, digestAlgorithm: .sha256)
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.swift.jwt.hardcoded-hmac-key -- <reason>

References