{"record":{"id":"e47eda927a3a4a0f","repo":"justauth/JustAuth","slug":"5013","errorCode":"5013","errorMessage":"Invalid team id","messagePattern":"Invalid team id","errorType":"exception","errorClass":"AuthException","httpStatus":null,"severity":"error","filePath":"src/main/java/me/zhyd/oauth/request/AuthAppleRequest.java","lineNumber":108,"sourceCode":"            .token(authToken)\n            .source(source.toString())\n            .build();\n    }\n\n    @Override\n    protected void checkConfig(AuthConfig config) {\n        super.checkConfig(config);\n        if (StringUtils.isEmpty(config.getClientId())) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_CLIENT_ID, source);\n        }\n        if (StringUtils.isEmpty(config.getClientSecret())) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_CLIENT_SECRET, source);\n        }\n        if (StringUtils.isEmpty(config.getKid())) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_KID, source);\n        }\n        if (StringUtils.isEmpty(config.getTeamId())) {\n            throw new AuthException(AuthResponseStatus.ILLEGAL_TEAM_ID, source);\n        }\n    }\n\n    /**\n     * 获取token\n     * @see <a href=\"https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret\">creating-a-client-secret</a>\n     * @return jwt token\n     */\n    private String getToken() {\n        return Jwts.builder().header().add(AbstractJwk.KID.getId(), this.config.getKid()).and()\n            .issuer(this.config.getTeamId())\n            .subject(this.config.getClientId())\n            .audience().add(AUD).and()\n            .expiration(new Date(System.currentTimeMillis() + TimeUnit.MINUTES.toMillis(3)))\n            .issuedAt(new Date())\n            .signWith(getPrivateKey())\n            .compact();\n    }","sourceCodeStart":90,"sourceCodeEnd":126,"githubUrl":"https://github.com/justauth/JustAuth/blob/694bbf1b010d93404e3bfb4824d90e9ddfaebebb/src/main/java/me/zhyd/oauth/request/AuthAppleRequest.java#L90-L126","documentation":"AuthException with AuthResponseStatus.ILLEGAL_TEAM_ID (code 5013) from AuthAppleRequest.checkConfig: config.getTeamId() is empty. The team id is the JWT issuer claim when JustAuth builds the client secret (getToken() uses issuer(this.config.getTeamId())), and Apple validates it against the key's owning team.","triggerScenarios":"Constructing AuthAppleRequest without teamId in AuthConfig. This is the last of the four Apple-specific config checks (clientId, clientSecret, kid, teamId).","commonSituations":"teamId omitted because other providers do not need it; membership in the Apple Developer Program transferred so the team id changed; multi-team orgs using the wrong 10-character team id.","solutions":["Set teamId to the 10-character Membership/Team ID from the Apple developer console (top-right of the console)","After a team/organization change, refresh teamId, kid and the .p8 together and re-verify","Add a startup assertion that all four Apple fields are present for the APPLE source"],"exampleFix":"// before\nAuthConfig.builder().clientId(\"com.yourapp.auth\").kid(\"ABC123DEFG\").build();\n\n// after\nAuthConfig.builder()\n    .clientId(\"com.yourapp.auth\")\n    .kid(\"ABC123DEFG\")\n    .teamId(\"WXYZ1234AB\")...","handlingStrategy":"validation","validationCode":"if (StringUtils.isEmpty(config.getTeamId()) || !config.getTeamId().matches(\"[A-Z0-9]{10}\")) {\n    throw new IllegalStateException(\"APPLE teamId must be the 10-char Membership Team ID\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Verify team id from the developer console membership page after any org transfer","Keep teamId next to kid/.p8/Services ID in one config block","Fail fast at boot rather than at first sign-in"],"tags":["apple","config","validation","team-id"],"backgroundTag":null,"analyzedSha":"694bbf1b010d93404e3bfb4824d90e9ddfaebebb","analyzedAt":"2026-08-14T15:16:59.945Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}