# X_KEYED_HASHER

## Means

an HMAC is taken with a keyed `new Bun.CryptoHasher(alg, key)` instead of `hmac()`

## Typical cause

any file outside `packages/core/src/hmac.ts` — shipped source, a test, a fixture, a tracked app — constructs `CryptoHasher` with two arguments. Under Bun 1.4.4 a failed WebCrypto EC import anywhere in the process (one bad JWKS or VAPID key) makes the next keyed hasher throw that stale OpenSSL error once, so a webhook signature, a cursor or a TOTP code fails for one request. An unkeyed hasher is plain hashing, unaffected, and never reported

## Fix

edit the file the finding names — `import { hmac } from '@ultimat3/core'` and write `hmac('sha256', key, data, 'hex')`, then `bun run keyed-hasher --json`

[CLI and verify](/error-codes#cli-and-verify)