SonarSource/sonarqube · error · IllegalArgumentException

Invalid appId;

Error message

Invalid appId; 

What it means

GithubGlobalSettingsValidator.buildConfiguration parses the GitHub App ID string into a long. If the value is present but not a valid number, this IllegalArgumentException is thrown including the NumberFormatException message. It means the configured appId is malformed.

Solutions

1. Copy the numeric App ID from GitHub App settings page (About section) — not the Client ID.
2. Trim whitespace and remove any non-numeric characters from the appId setting.
3. Re-save the GitHub DevOps platform configuration in SonarQube with the corrected appId.
4. Verify via the GitHub API: GET /apps/{app-id} should resolve your App.

Example fix

// before
appId = "Iv1.8f2a9c1b"; // Client ID pasted by mistake
// after
appId = "123456"; // numeric App ID from App settings > About

// client-side guard before saving settings
function isValidAppId(v) { return v != null && /^\d+$/.test(v.trim()); }
if (!isValidAppId(applicationId)) throw new Error("appId must be numeric (see GitHub App settings > About)");

function isNumericAppId(v) { return typeof v === 'string' && /^\d+$/.test(v.trim()); }

try { validator.configuration(appId, clientId, secret, key, url); } catch (IllegalArgumentException e) { if (e.getMessage().startsWith("Invalid appId")) { showFieldError("appId", "Enter the numeric App ID from GitHub App settings"); } throw e; }

When it happens

Trigger: Calling configuration(...) with an applicationId like 'Iv1.abc123', '12345abc', a Client ID pasted into the App ID field, or extra whitespace/characters.

Common situations: Developers confuse the GitHub App ID (numeric, from App settings > About) with the Client ID (starts with Iv1. or Ov23li), copy/paste including invisible characters, or leave a placeholder text in the field.

Understand the failure class

Background: "Invalid ... format", "must be in format X", "does not look like a ..." — invalid argument format errors across CLI tools and libraries — this error's family across 17 libraries.

Related errors

• Failed to check permissions with Github, check the…
• Invalid URL
• Missing Client Id
• Missing Client Secret
• Missing URL

AI-assisted analysis of SonarSource/sonarqube@184c821202 (2026-09-09). Data as JSON: /api/errors/56801485bf6b4516. Report an issue: GitHub.

Appendix: source

Thrown at server/sonar-alm-client/src/main/java/org/sonar/alm/client/github/GithubGlobalSettingsValidator.java:96

   * (empty when all {@code requiredPermissions} are granted) instead of throwing when some are missing — for callers
   * that need the structured result (SONAR-31626). Still throws {@link IllegalArgumentException} on invalid
   * configuration, authentication or connectivity failures.
   */
  public List<String> findMissingPermissions(AlmSettingDto almSettingDto, Map<String, String> requiredPermissions) {
    GithubAppConfiguration configuration = buildConfiguration(almSettingDto.getAppId(), almSettingDto.getClientId(),
      almSettingDto.getClientSecret(), almSettingDto.getPrivateKey(), almSettingDto.getUrl());

    githubApplicationClient.checkApiEndpoint(configuration);
    return githubApplicationClient.findMissingAppPermissions(configuration, requiredPermissions);
  }

  private GithubAppConfiguration buildConfiguration(@Nullable String applicationId, @Nullable String clientId, String clientSecret, String privateKey,
    @Nullable String url) {
    long appId;
    try {
      appId = Long.parseLong(Optional.ofNullable(applicationId).orElseThrow(() -> new IllegalArgumentException("Missing appId")));
    } catch (NumberFormatException e) {
      throw new IllegalArgumentException("Invalid appId; " + e.getMessage());
    }
    if (isBlank(clientId)) {
      throw new IllegalArgumentException("Missing Client Id");
    }
    if (isBlank(getDecryptedSettingValue(clientSecret))) {
      throw new IllegalArgumentException("Missing Client Secret");
    }
    return new GithubAppConfiguration(appId, getDecryptedSettingValue(privateKey), url);
  }

  private String getDecryptedSettingValue(String setting) {
    if (StringUtils.isNotEmpty(setting) && encryption.isEncrypted(setting)) {
      return encryption.decrypt(setting);
    }
    return setting;
  }
}

View on GitHub (pinned to 184c821202)