LINE error 404: Cannot find channel key that satisfies the conditions

One of the JWT-based token endpoints - issue channel access token v2.1, get all valid channel access token key IDs v2.1, or issue a stateless channel access token with a JWT assertion - couldn't match your JWT to a key registered on the channel. The documented 404 row reads: "The signature key associated with the JWT assertion isn't registered in the channel."

Channel access token v2.1 works with an assertion signing key pair. You generate the key pair yourself, register the public key in the LINE Developers Console for the channel, and the console gives you a kid. Your JWT header must carry that kid, and the JWT must be signed with the matching private key. LINE looks up the key by kid on the channel named in the iss and sub claims; if no such key exists there, you get this 404.

This is different from a JWT that LINE can find a key for but can't verify, or that has expired. Those come back as 400 with the invalid_client shape (for example "iss and clientId of key do not match" or "Invalid exp"), covered under invalid_client. A 404 means no key was found at all.

// If the signature key associated with the JWT assertion isn't registered in the channel (404 Not Found)
{
  "message": "Cannot find channel key that satisfies the conditions"
}

Keep channel ID, kid, and private key together as one secret per environment instead of three separate variables that can drift. When you rotate assertion keys, register the new public key first, deploy the new kid, and delete the old key only after nothing signs with it. A startup self-test that issues and then revokes a token catches mismatches before traffic arrives.