diff --git a/plugins/auth-backend/migrations/20200619125845_init.js b/plugins/auth-backend/migrations/20200619125845_init.js
index d5fc08ce48..6697d168c0 100644
--- a/plugins/auth-backend/migrations/20200619125845_init.js
+++ b/plugins/auth-backend/migrations/20200619125845_init.js
@@ -20,6 +20,13 @@
  * @param {import('knex').Knex} knex
  */
 exports.up = async function up(knex) {
+  /**
+   * key field length. must be enough for the chosen JWT signing algorithm.
+   * the default value is set to be enough for all supported algorithms of the
+   * `jose` library.
+   */
+  const SIGNING_KEY_MAX_LENGTH = 512;
+
   return knex.schema.createTable('signing_keys', table => {
     table.comment(
       'Signing keys that are currently in use or have recently been used to issue tokens',
@@ -34,7 +41,10 @@ exports.up = async function up(knex) {
       .notNullable()
       .defaultTo(knex.fn.now())
       .comment('The creation time of the key');
-    table.string('key').notNullable().comment('The serialized signing key');
+    table
+      .string('key', SIGNING_KEY_MAX_LENGTH)
+      .notNullable()
+      .comment('The serialized signing key');
   });
 };
 
diff --git a/plugins/auth-backend/src/identity/TokenFactory.ts b/plugins/auth-backend/src/identity/TokenFactory.ts
index fe9d2a1b4f..fdc7210650 100644
--- a/plugins/auth-backend/src/identity/TokenFactory.ts
+++ b/plugins/auth-backend/src/identity/TokenFactory.ts
@@ -34,6 +34,9 @@ type Options = {
   keyDurationSeconds: number;
   /** JWS "alg" (Algorithm) Header Parameter value. Defaults to ES256.
    * Must match one of the algorithms defined for IdentityClient.
+   * When setting a different algorithm, check if the `key` field
+   * of the `signing_keys` table can fit the length of the generated keys.
+   * If not, modify the migration file in the migrations folder.
    * More info on supported algorithms: https://github.com/panva/jose */
   algorithm?: string;
 };