AlistGo/alist · error

e.Error

Error message

e.Error

What it means

JWT-bearer token refresh path in the Google Drive driver: when authenticating with a service-account assertion, Google's token endpoint returned an error string in the response, returned verbatim as the error. Typical values are 'invalid_grant' (bad/audience-mismatched assertion) or 'invalid_client'.

Source

Thrown at drivers/google_drive/util.go:125

			})
		assertion, err := jwtToken.SignedString(privateKey)
		if err != nil {
			return err
		}

		var resp base.TokenResp
		var e TokenError
		res, err := base.RestyClient.R().SetResult(&resp).SetError(&e).
			SetFormData(map[string]string{
				"assertion":  assertion,
				"grant_type": "urn:ietf:params:oauth:grant-type:jwt-bearer",
			}).Post(jsonData.TokenURI)
		if err != nil {
			return err
		}
		log.Debug(res.String())
		if e.Error != "" {
			return fmt.Errorf(e.Error)
		}
		d.AccessToken = resp.AccessToken
		return nil
	} else if os.IsExist(gdsaFileErr) {
		return gdsaFileErr
	}
	url := "https://www.googleapis.com/oauth2/v4/token"
	var resp base.TokenResp
	var e TokenError
	res, err := base.RestyClient.R().SetResult(&resp).SetError(&e).
		SetFormData(map[string]string{
			"client_id":     d.ClientID,
			"client_secret": d.ClientSecret,
			"refresh_token": d.RefreshToken,
			"grant_type":    "refresh_token",
		}).Post(url)
	if err != nil {
		return err

View on GitHub (pinned to 843d9dc814)

Solutions

1. Sync system time (NTP) — invalid_grant from skew is the classic cause
2. Re-download the intact service-account JSON and reconfigure it in the driver
3. Enable the Google Drive API and verify quota in the Cloud console for the project
4. Decode the JWT assertion and confirm iss/sub/aud/scope match the Drive setup

func isTokenGrantError(err error) bool {
  return err != nil && (strings.Contains(err.Error(), "invalid_grant") || strings.Contains(err.Error(), "invalid_client"))
}

if err := d.refreshToken(); err != nil {
  if isTokenGrantError(err) {
    // credential is bad: do NOT retry; surface reconfiguration to the operator
  }
}

When it happens

Trigger: refreshToken posting grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer with the signed assertion where Google rejects it: expired clock skew (>60s), wrong audience/token URI, malformed or unauthorized service-account JSON, or a revoked key.

Common situations: Server clock drift; service-account JSON truncated when pasted; API not enabled for the project (drive.googleapis.com); GDSA (shared-drive service account) banned by Google; using the wrong token endpoint for the workload.

Related errors

• not a jwt token because of invalid segments
• failed to refresh token: refresh token is empty
• failed to refresh token: sub not match
• failed to decode jwt token
• lark refresh token expired

AI-assisted analysis of AlistGo/alist@843d9dc814 (2026-08-15). Data as JSON: /api/errors/e1a75aad32321f18. Report an issue: GitHub.