{"record":{"id":"a3409bfa1664f355","repo":"justauth/JustAuth","slug":"5012","errorCode":"5012","errorMessage":"Invalid key identifier(kid)","messagePattern":"Invalid key identifier\\(kid\\)","errorType":"exception","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/request/AuthAppleRequest.java","lineNumber":105,"sourceCode":"            .uuid(object.getString(\"sub\"))\n            .email(object.getString(\"email\"))\n            .username(authToken.getUsername())\n            .token(authToken)\n            .source(source.toString())\n            .build();\n    }\n\n    @Override\n    protected void checkConfig(AuthConfig config) {\n        super.checkConfig(config);\n        if (StringUtils.isEmpty(config.getClientId())) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_CLIENT_ID, source);\n        }\n        if (StringUtils.isEmpty(config.getClientSecret())) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_CLIENT_SECRET, source);\n        }\n        if (StringUtils.isEmpty(config.getKid())) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_KID, source);\n        }\n        if (StringUtils.isEmpty(config.getTeamId())) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_TEAM_ID, source);\n        }\n    }\n\n    /**\n     * 获取token\n     * @see <a href=\"https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret\">creating-a-client-secret</a>\n     * @return jwt token\n     */\n    private String getToken() {\n        return Jwts.builder().header().add(AbstractJwk.KID.getId(), this.config.getKid()).and()\n            .issuer(this.config.getTeamId())\n            .subject(this.config.getClientId())\n            .audience().add(AUD).and()\n            .expiration(new Date(System.currentTimeMillis() + TimeUnit.MINUTES.toMillis(3)))\n            .issuedAt(new Date())","sourceCodeStart":87,"sourceCodeEnd":123,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/request/AuthAppleRequest.java#L87-L123","documentation":"AuthException with AuthResponseStatus.ILLEGAL_KID (code 5012) from AuthAppleRequest.checkConfig: config.getKid() is empty. The kid (key identifier) is embedded as the JWT header when JustAuth mints the client-secret JWT in getToken(), and Apple rejects secrets without it.","triggerScenarios":"Building AuthAppleRequest with no kid in AuthConfig. Even before this throws, Apple would fail token requests; JustAuth fails fast at construction.","commonSituations":"kid confused with teamId or Services ID; key revoked in the console and config regenerated minus kid; kid exists in a secret store not wired to this service.","solutions":["Set kid to the 10-character Key ID shown next to the Sign in with Apple key in the Apple developer console","Keep kid, teamId, .p8 secret and Services ID together in one config unit so they cannot drift apart","If the key was regenerated, update kid and the .p8 content simultaneously"],"exampleFix":"// before\nAuthConfig.builder().clientId(\"com.yourapp.auth\").build();\n\n// after\nAuthConfig.builder()\n    .clientId(\"com.yourapp.auth\")\n    .kid(\"ABC123DEFG\")\n    .teamId(\"WXYZ1234AB\")...","handlingStrategy":"validation","validationCode":"if (StringUtils.isEmpty(config.getKid()) || !config.getKid().matches(\"[A-Z0-9]{10}\")) {\n    throw new IllegalStateException(\"APPLE kid must be the 10-char Key ID from the developer console\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Copy the Key ID exactly from the console row of the Sign in with Apple key","Rotate kid and .p8 content as a pair","Unit-test config assembly for the APPLE source"],"tags":["apple","config","validation","kid"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}