Session key is not valid base64url

parseKey decodes the key before any cryptography runs, and throws when the decode fails.

base64url, specifically

Not standard base64. The URL-safe alphabet substitutes - for + and _ for /, and omits padding — because the key travels in a URL fragment, where + and / are hazardous.

That distinction is the usual cause. A key that round-trips through something assuming standard base64 comes back with the wrong characters and fails here.

The sibling check

Immediately after, the length is verified:

Session key must decode to N bytes, got M. The link is truncated or was not produced by sessionCrypto.generateKey().

Two errors rather than one, because they mean different things. Invalid encoding suggests something rewrote the fragment; a valid decode of the wrong length suggests truncation or a key from another source.

What causes it

URL-encoding the fragment. A client that percent-encodes the whole link turns - and _ into escapes.

Line wrapping. A link broken across lines in an email or chat message, reassembled with a newline still in it.

Manual construction. A key generated by something other than generateKey().

How to fix it

Copy the link as unbroken text from its original source. If it was reconstructed by hand, it will not work — and note that a well-formed key which simply belongs to a different session fails later and differently.

Two errors, deliberately

Encoding and length are checked separately because they point at different culprits. A decode failure means something rewrote the fragment in transit. A clean decode of the wrong length means the link was cut short, or the key came from somewhere other than the generator.

Collapsing both into "invalid key" would save a branch and cost the diagnosis — the same reasoning behind keeping the structural ciphertext check separate from the decryption failure.