{"record":{"id":"e1a75aad32321f18","repo":"AlistGo/alist","slug":"e-error-e1a75a","errorCode":null,"errorMessage":"e.Error","messagePattern":"e\\.Error","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"drivers/google_drive/util.go","lineNumber":125,"sourceCode":"\t\t\t})\n\t\tassertion, err := jwtToken.SignedString(privateKey)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\n\t\tvar resp base.TokenResp\n\t\tvar e TokenError\n\t\tres, err := base.RestyClient.R().SetResult(&resp).SetError(&e).\n\t\t\tSetFormData(map[string]string{\n\t\t\t\t\"assertion\":  assertion,\n\t\t\t\t\"grant_type\": \"urn:ietf:params:oauth:grant-type:jwt-bearer\",\n\t\t\t}).Post(jsonData.TokenURI)\n\t\tif err != nil {\n\t\t\treturn err\n\t\t}\n\t\tlog.Debug(res.String())\n\t\tif e.Error != \"\" {\n\t\t\treturn fmt.Errorf(e.Error)\n\t\t}\n\t\td.AccessToken = resp.AccessToken\n\t\treturn nil\n\t} else if os.IsExist(gdsaFileErr) {\n\t\treturn gdsaFileErr\n\t}\n\turl := \"https://www.googleapis.com/oauth2/v4/token\"\n\tvar resp base.TokenResp\n\tvar e TokenError\n\tres, err := base.RestyClient.R().SetResult(&resp).SetError(&e).\n\t\tSetFormData(map[string]string{\n\t\t\t\"client_id\":     d.ClientID,\n\t\t\t\"client_secret\": d.ClientSecret,\n\t\t\t\"refresh_token\": d.RefreshToken,\n\t\t\t\"grant_type\":    \"refresh_token\",\n\t\t}).Post(url)\n\tif err != nil {\n\t\treturn err","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/AlistGo/alist/blob/843d9dc8149126976b2625911e45a4d3ffd6f2f5/drivers/google_drive/util.go#L107-L143","documentation":"JWT-bearer token refresh path in the Google Drive driver: when authenticating with a service-account assertion, Google's token endpoint returned an error string in the response, returned verbatim as the error. Typical values are 'invalid_grant' (bad/audience-mismatched assertion) or 'invalid_client'.","triggerScenarios":"refreshToken posting grant_type=urn:ietf:params:oauth:grant-type:jwt-bearer with the signed assertion where Google rejects it: expired clock skew (>60s), wrong audience/token URI, malformed or unauthorized service-account JSON, or a revoked key.","commonSituations":"Server clock drift; service-account JSON truncated when pasted; API not enabled for the project (drive.googleapis.com); GDSA (shared-drive service account) banned by Google; using the wrong token endpoint for the workload.","solutions":["Sync system time (NTP) — invalid_grant from skew is the classic cause","Re-download the intact service-account JSON and reconfigure it in the driver","Enable the Google Drive API and verify quota in the Cloud console for the project","Decode the JWT assertion and confirm iss/sub/aud/scope match the Drive setup"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"func isTokenGrantError(err error) bool {\n  return err != nil && (strings.Contains(err.Error(), \"invalid_grant\") || strings.Contains(err.Error(), \"invalid_client\"))\n}","tryCatchPattern":"if err := d.refreshToken(); err != nil {\n  if isTokenGrantError(err) {\n    // credential is bad: do NOT retry; surface reconfiguration to the operator\n  }\n}","preventionTips":["Run NTP on servers using JWT-bearer auth to avoid skew-driven invalid_grant","Store the full service-account JSON verbatim; validate it parses before saving config"],"tags":["google-drive","oauth","service-account","jwt"],"backgroundTag":null,"analyzedSha":"843d9dc8149126976b2625911e45a4d3ffd6f2f5","analyzedAt":"2026-08-15T12:14:11.722Z","schemaVersion":2},"datasetVersion":"2026-08-16T03:17:38.424Z"}