{"record":{"id":"a7791f5e05f0e91e","repo":"apolloconfig/apollo","slug":"token-is-illegal","errorCode":null,"errorMessage":"Token is Illegal","messagePattern":"Token is Illegal","errorType":"validation","errorClass":"BadRequestException","httpStatus":400,"severity":"error","filePath":"apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/service/ConsumerService.java","lineNumber":169,"sourceCode":"\n  public Consumer getConsumerByConsumerId(long consumerId) {\n    return consumerRepository.findById(consumerId).orElse(null);\n  }\n\n  @Transactional\n  public List<ConsumerRole> assignNamespaceRoleToConsumer(String token, String appId,\n      String namespaceName, String operator) {\n    validateOperator(operator);\n    return assignNamespaceRoleToConsumer(token, appId, namespaceName, null, operator);\n  }\n\n  @Transactional\n  public List<ConsumerRole> assignNamespaceRoleToConsumer(String token, String appId,\n      String namespaceName, String env, String operator) {\n    validateOperator(operator);\n    Long consumerId = getConsumerIdByToken(token);\n    if (consumerId == null) {\n      throw new BadRequestException(\"Token is Illegal\");\n    }\n\n    Role namespaceModifyRole = rolePermissionService\n        .findRoleByRoleName(RoleUtils.buildModifyNamespaceRoleName(appId, namespaceName, env));\n    Role namespaceReleaseRole = rolePermissionService\n        .findRoleByRoleName(RoleUtils.buildReleaseNamespaceRoleName(appId, namespaceName, env));\n\n    if (namespaceModifyRole == null || namespaceReleaseRole == null) {\n      throw new BadRequestException(\n          \"Namespace's role does not exist. Please check whether namespace has created.\");\n    }\n\n    long namespaceModifyRoleId = namespaceModifyRole.getId();\n    long namespaceReleaseRoleId = namespaceReleaseRole.getId();\n\n    ConsumerRole managedModifyRole =\n        consumerRoleRepository.findByConsumerIdAndRoleId(consumerId, namespaceModifyRoleId);\n    ConsumerRole managedReleaseRole =","sourceCodeStart":151,"sourceCodeEnd":187,"githubUrl":"https://github.com/apolloconfig/apollo/blob/d95fc18d112589efc09ddcbe1507047584d55251/apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/service/ConsumerService.java#L151-L187","documentation":"Thrown as BadRequestException (HTTP 400) by ConsumerService.assignNamespaceRoleToConsumer when getConsumerIdByToken(token) returns null — the supplied token does not resolve to a known Consumer. The token is invalid, expired/revoked, or malformed.","triggerScenarios":"Calling assignNamespaceRoleToConsumer(token, appId, namespaceName, [env], operator) with a token that maps to no Consumer row.","commonSituations":"Wrong token copied; token from a different Apollo deployment; consumer/token deleted or regenerated; whitespace or truncation in the token.","solutions":["Verify the token against the Consumer's stored token in the portal DB.","Regenerate the token from the correct Consumer if it was revoked.","Trim whitespace and confirm the token belongs to this Apollo cluster."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"Long consumerId = consumerService.getConsumerIdByToken(token);\nif (consumerId == null) {\n  // invalid/revoked token — do not call assignNamespaceRoleToConsumer\n}","typeGuard":null,"tryCatchPattern":"try {\n  consumerService.assignNamespaceRoleToConsumer(token, appId, namespaceName, env, operator);\n} catch (BadRequestException e) {\n  if (\"Token is Illegal\".equals(e.getMessage())) {\n    // refresh/regenerate the token and retry\n  } else throw e;\n}","preventionTips":["Store and rotate consumer tokens securely; trim whitespace.","Resolve the token to a consumerId before role assignment.","Regenerate tokens only through the portal consumer management flow."],"tags":["consumer","token","openapi","bad-request","apollo-portal","authentication"],"backgroundTag":null,"analyzedSha":"d95fc18d112589efc09ddcbe1507047584d55251","analyzedAt":"2026-08-14T04:00:05.477Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}