{"record":{"id":"f60112d19ef3dc94","repo":"iflytek/astron-agent","slug":"tenant-verify-app-auth-request-failed-status","errorCode":null,"errorMessage":"tenant verify app auth request failed, status={}","messagePattern":"tenant verify app auth request failed, status=(.+?)","errorType":"console","errorClass":null,"httpStatus":null,"severity":"error","filePath":"console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/gateway/impl/HttpTenantGatewayAuthClient.java","lineNumber":75,"sourceCode":"                    TenantInternalApiKey.requireConfigured(tenantInternalKey);\n        } catch (IllegalStateException exception) {\n            log.warn(\"Tenant internal authentication is not configured; verification was not sent\");\n            return Optional.empty();\n        }\n\n        JSONObject requestBody = new JSONObject();\n        requestBody.put(\"api_key\", apiKey);\n        requestBody.put(\"api_secret\", apiSecret);\n\n        Request request = new Request.Builder()\n                .url(verifyAppAuthUrl)\n                .header(TenantInternalApiKey.HEADER, configuredInternalKey)\n                .post(RequestBody.create(requestBody.toJSONString(), JSON_MEDIA_TYPE))\n                .build();\n\n        try (Response response = httpClient.newCall(request).execute()) {\n            if (!response.isSuccessful()) {\n                log.warn(\"tenant verify app auth request failed, status={}\", response.code());\n                return Optional.empty();\n            }\n            return parseAppId(response.body());\n        } catch (IOException | RuntimeException ex) {\n            log.warn(\n                    \"Tenant application credential verification request failed: {}\",\n                    ex.getClass().getSimpleName());\n            return Optional.empty();\n        }\n    }\n\n    private Optional<String> parseAppId(ResponseBody body) throws IOException {\n        if (body == null) {\n            return Optional.empty();\n        }\n        JSONObject responseJson = JSON.parseObject(body.string());\n        Integer code = responseJson == null ? null : responseJson.getInteger(\"code\");\n        if (code == null || code != 0) {","sourceCodeStart":57,"sourceCodeEnd":93,"githubUrl":"https://github.com/iflytek/astron-agent/blob/5e758547a83371a5a4b29dadf4ac03e8dd527635/console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/gateway/impl/HttpTenantGatewayAuthClient.java#L57-L93","documentation":"verify() sends the credential-verification POST to the tenant service; when the HTTP response status is not 2xx (response.isSuccessful() false), it logs \"tenant verify app auth request failed, status={}\" with the status code and returns Optional.empty(). The credentials are treated as unverified; the tenant service explicitly rejected or errored on the request.","triggerScenarios":"Tenant verify-app-auth endpoint returns 401 (bad internal key), 403, 404 (wrong path), 500 (tenant service error), or any non-success status for the given apiKey/apiSecret.","commonSituations":"Wrong verifyAppAuthUrl path after service rename; internal key mismatch after rotation; tenant service down behind a proxy returning 502/503; app credentials revoked on the tenant side.","solutions":["Read the logged status code and check tenant service logs for the matching request.","Confirm the verify-app-auth URL path matches the tenant service's current API.","Re-sync the internal API key between console backend and tenant service (rotation drift).","Test credentials directly: curl -H internal-key -d '{api_key,api_secret}' <verify-url>."],"exampleFix":"// before\nif (!response.isSuccessful()) { log.warn(...); return Optional.empty(); }\n// after\nif (!response.isSuccessful()) {\n    log.warn(\"tenant verify app auth request failed, status={}, body={}\", response.code(), safeBody(response));\n    if (response.code() >= 500) throw new IllegalStateException(\"tenant verify unavailable\");\n    return Optional.empty();\n}","handlingStrategy":"try-catch","validationCode":"// pre-flight connectivity\nResponse ping = httpClient.newCall(headRequest(verifyAppAuthUrl)).execute();\nif (ping.code() == 404) throw new IllegalStateException(\"verify-app-auth path wrong\");","typeGuard":null,"tryCatchPattern":"Optional<String> appId = authClient.verify(apiKey, apiSecret);\nif (appId.isEmpty()) {\n    // inspect logs for \"status={}\"; distinguish 4xx (bad creds/key) from 5xx (tenant outage)\n    metrics.increment(\"tenant.verify.failed\", \"outcome\", \"http-status\");\n}","preventionTips":["Keep verifyAppAuthUrl in sync with the tenant service API version.","Rotate the internal key on both sides atomically.","Log response body safely for 4xx to ease debugging.","Alert on sustained non-2xx rates from the tenant verify endpoint."],"tags":["http","authentication","tenant-gateway","http-error-response"],"backgroundTag":"http-error-response","analyzedSha":"5e758547a83371a5a4b29dadf4ac03e8dd527635","analyzedAt":"2026-09-12T08:03:51.356Z","contentChangedAt":"2026-09-12T08:03:51.356Z","schemaVersion":2},"datasetVersion":"2026-09-15T23:17:13.987Z"}