diff --git a/app/main/views/sign_in.py b/app/main/views/sign_in.py
index c0c4b7650..5e6899eae 100644
--- a/app/main/views/sign_in.py
+++ b/app/main/views/sign_in.py
@@ -26,10 +26,24 @@ from app.utils import hide_from_search_engines
 from app.utils.login import is_safe_redirect_url
 
 
+def _reformat_keystring(orig):
+    new_keystring = orig.replace("-----BEGIN PRIVATE KEY-----", "")
+    new_keystring = new_keystring.replace("-----END PRIVATE KEY-----", "")
+    new_keystring = new_keystring.strip()
+    new_keystring = "\n".join(
+        ["-----BEGIN PRIVATE KEY-----", new_keystring, "-----END PRIVATE KEY-----"]
+    )
+    new_keystring = f"{new_keystring}\n"
+    return new_keystring
+
+
 def _get_access_token(code, state):
     client_id = os.getenv("LOGIN_DOT_GOV_CLIENT_ID")
     access_token_url = os.getenv("LOGIN_DOT_GOV_ACCESS_TOKEN_URL")
     keystring = os.getenv("LOGIN_PEM")
+    if " " in keystring:
+        keystring = _reformat_keystring(keystring)
+
     payload = {
         "iss": client_id,
         "sub": client_id,
@@ -174,7 +188,7 @@ def sign_in():
     current_app.logger.info(
         f"LOGIN_DOT_GOV_SIGNOUT_REDIRECT={os.getenv('LOGIN_DOT_GOV_SIGNOUT_REDIRECT')}"
     )
-    initial_signin_url = os.getenv('LOGIN_DOT_GOV_INITIAL_SIGNIN_URL')
+    initial_signin_url = os.getenv("LOGIN_DOT_GOV_INITIAL_SIGNIN_URL")
     current_app.logger.info(f"LOGIN_DOT_GOV_INITIAL_SIGNIN_URL={initial_signin_url}")
 
     return render_template(
diff --git a/tests/app/main/views/test_index.py b/tests/app/main/views/test_index.py
index 0b584962a..7311dbaaa 100644
--- a/tests/app/main/views/test_index.py
+++ b/tests/app/main/views/test_index.py
@@ -15,7 +15,9 @@ def test_non_logged_in_user_can_see_homepage(
     client_request.logout()
     page = client_request.get("main.index", _test_page_title=False)
 
-    assert page.h1.text.strip() == ("Reach people where they are with government-powered text messages")
+    assert page.h1.text.strip() == (
+        "Reach people where they are with government-powered text messages"
+    )
 
     assert page.select_one("a.usa-button.usa-button--big")["href"] == url_for(
         "main.sign_in",
diff --git a/tests/app/main/views/test_sign_in.py b/tests/app/main/views/test_sign_in.py
index 018321fbe..345a1bd94 100644
--- a/tests/app/main/views/test_sign_in.py
+++ b/tests/app/main/views/test_sign_in.py
@@ -3,6 +3,7 @@ import uuid
 import pytest
 from flask import url_for
 
+from app.main.views.sign_in import _reformat_keystring
 from app.models.user import User
 from tests.conftest import SERVICE_ONE_ID, normalize_spaces
 
@@ -39,6 +40,16 @@ def test_render_sign_in_template_with_next_link_for_password_reset(client_reques
     )
 
 
+def test_reformat_keystring():
+    orig = "-----BEGIN PRIVATE KEY----- blahblahblah -----END PRIVATE KEY-----"
+    expected = """-----BEGIN PRIVATE KEY-----
+blahblahblah
+-----END PRIVATE KEY-----
+"""
+    reformatted = _reformat_keystring(orig)
+    assert reformatted == expected
+
+
 def test_sign_in_explains_session_timeout(client_request):
     client_request.logout()
     page = client_request.get("main.sign_in", next="/foo")
diff --git a/tests/app/main/views/test_templates.py b/tests/app/main/views/test_templates.py
index 4fddce76d..b74b5b6d7 100644
--- a/tests/app/main/views/test_templates.py
+++ b/tests/app/main/views/test_templates.py
@@ -632,7 +632,7 @@ def test_should_show_sms_template_with_downgraded_unicode_characters(
     fake_uuid,
 ):
     msg = "here:\tare some “fancy quotes” and zero\u200Bwidth\u200Bspaces"
-    rendered_msg = 'here: are some “fancy quotes” and zerowidthspaces'
+    rendered_msg = "here: are some “fancy quotes” and zerowidthspaces"
 
     mocker.patch(
         "app.service_api_client.get_service_template",