ValueError: This key may not be safe to import when decoding RS256 encoded JWT

[nextmat]

When I use JWT decoding with a RS256 encoded pub key:

jwt.decode(token, pub_key)

I get *** ValueError: This key may not be safe to import. This seems to originate in import_from_bytes which checks the key prefix against this constant.

Since -----BEGIN is in this list, it seems like no PEM-formatted keys would work with joserfc?

This key works fine with PyJWT and I'm a bit confused by what the problem is. What is the risk here?

Thanks!

[lepture]

@nextmat you need to specify the key with:

key = RSAKey.import_key(pub_key_bytes)
jwt.decode(token, key)

[nextmat]

This solved my problem, thank you!