{"record":{"id":"7a4f458e453d617a","repo":"justauth/JustAuth","slug":"5011","errorCode":"5011","errorMessage":"Invalid token","messagePattern":"Invalid token","errorType":"exception","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/request/AuthAmazonRequest.java","lineNumber":171,"sourceCode":"        this.checkResponse(jsonObject);\n\n        return AuthUser.builder()\n            .rawUserInfo(jsonObject)\n            .uuid(jsonObject.getString(\"user_id\"))\n            .username(jsonObject.getString(\"name\"))\n            .nickname(jsonObject.getString(\"name\"))\n            .email(jsonObject.getString(\"email\"))\n            .gender(AuthUserGender.UNKNOWN)\n            .source(source.toString())\n            .token(authToken)\n            .build();\n    }\n\n    private void checkToken(String accessToken) {\n        String tokenInfo = new HttpUtils(config.getHttpConfig()).get(\"https://api.amazon.com/auth/o2/tokeninfo?access_token=\" + UrlUtil.urlEncode(accessToken)).getBody();\n        JSONObject jsonObject = JSONObject.parseObject(tokenInfo);\n        if (!config.getClientId().equals(jsonObject.getString(\"aud\"))) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_TOKEN);\n        }\n    }\n\n    @Override\n    protected String userInfoUrl(AuthToken authToken) {\n        return UrlBuilder.fromBaseUrl(source.userInfo())\n            .queryParam(\"user_id\", authToken.getUserId())\n            .queryParam(\"screen_name\", authToken.getScreenName())\n            .queryParam(\"include_entities\", true)\n            .build();\n    }\n}\n","sourceCodeStart":153,"sourceCodeEnd":184,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/request/AuthAmazonRequest.java#L153-L184","documentation":"AuthException with AuthResponseStatus.ILLEGAL_TOKEN (code 5011) thrown by AuthAmazonRequest.checkToken: it calls https://api.amazon.com/auth/o2/tokeninfo with the access token and requires the returned aud (audience) to equal config.getClientId(). A mismatch means the token was issued to a different client.","triggerScenarios":"AuthAmazonRequest.getAccessToken (and hence login) with an access token minted for a different Amazon client id — e.g. tokens from a second security profile, another environment, or a stale token store keyed incorrectly.","commonSituations":"Shared token cache across dev/prod apps that use different client ids; security profile recreated after deletion and old tokens replayed; clientId typo so the comparison never matches.","solutions":["Clear cached Amazon tokens and re-run the OAuth flow with the current clientId","Confirm only one security profile per environment and that the token store is keyed by clientId","Double-check clientId in AuthConfig against the LWA console"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"if (StringUtils.isEmpty(config.getClientId())) {\n    throw new IllegalStateException(\"AMAZON clientId required for token audience check\");\n}\n// before login: token cache must be keyed by clientId so foreign tokens are never replayed\nassert tokenCache.keySet().contains(config.getClientId());","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Key token stores by clientId+provider to prevent cross-app token leakage","Isolate dev/prod security profiles and their token stores","Treat ILLEGAL_TOKEN (5011) as a signal to clear the cache and re-auth, not as a transient error"],"tags":["amazon","oauth","token-validation","audience"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}