apolloconfig/apollo · error · BadRequestException

Token is Illegal

Error message

Token is Illegal

What it means

Thrown as BadRequestException (HTTP 400) by ConsumerService.assignNamespaceRoleToConsumer when getConsumerIdByToken(token) returns null — the supplied token does not resolve to a known Consumer. The token is invalid, expired/revoked, or malformed.

Source

Thrown at apollo-portal/src/main/java/com/ctrip/framework/apollo/openapi/service/ConsumerService.java:169

  public Consumer getConsumerByConsumerId(long consumerId) {
    return consumerRepository.findById(consumerId).orElse(null);
  }

  @Transactional
  public List<ConsumerRole> assignNamespaceRoleToConsumer(String token, String appId,
      String namespaceName, String operator) {
    validateOperator(operator);
    return assignNamespaceRoleToConsumer(token, appId, namespaceName, null, operator);
  }

  @Transactional
  public List<ConsumerRole> assignNamespaceRoleToConsumer(String token, String appId,
      String namespaceName, String env, String operator) {
    validateOperator(operator);
    Long consumerId = getConsumerIdByToken(token);
    if (consumerId == null) {
      throw new BadRequestException("Token is Illegal");
    }

    Role namespaceModifyRole = rolePermissionService
        .findRoleByRoleName(RoleUtils.buildModifyNamespaceRoleName(appId, namespaceName, env));
    Role namespaceReleaseRole = rolePermissionService
        .findRoleByRoleName(RoleUtils.buildReleaseNamespaceRoleName(appId, namespaceName, env));

    if (namespaceModifyRole == null || namespaceReleaseRole == null) {
      throw new BadRequestException(
          "Namespace's role does not exist. Please check whether namespace has created.");
    }

    long namespaceModifyRoleId = namespaceModifyRole.getId();
    long namespaceReleaseRoleId = namespaceReleaseRole.getId();

    ConsumerRole managedModifyRole =
        consumerRoleRepository.findByConsumerIdAndRoleId(consumerId, namespaceModifyRoleId);
    ConsumerRole managedReleaseRole =

View on GitHub (pinned to d95fc18d11)

Solutions

1. Verify the token against the Consumer's stored token in the portal DB.
2. Regenerate the token from the correct Consumer if it was revoked.
3. Trim whitespace and confirm the token belongs to this Apollo cluster.

Long consumerId = consumerService.getConsumerIdByToken(token);
if (consumerId == null) {
  // invalid/revoked token — do not call assignNamespaceRoleToConsumer
}

try {
  consumerService.assignNamespaceRoleToConsumer(token, appId, namespaceName, env, operator);
} catch (BadRequestException e) {
  if ("Token is Illegal".equals(e.getMessage())) {
    // refresh/regenerate the token and retry
  } else throw e;
}

When it happens

Trigger: Calling assignNamespaceRoleToConsumer(token, appId, namespaceName, [env], operator) with a token that maps to no Consumer row.

Common situations: Wrong token copied; token from a different Apollo deployment; consumer/token deleted or regenerated; whitespace or truncation in the token.

Related errors

• Consumer already exist
• Namespace's role does not exist. Please check whether namesp
• operator should not be null or empty
• Params(AppId) can not be empty.
• Params(NamespaceName) can not be empty.

AI-assisted analysis of apolloconfig/apollo@d95fc18d11 (2026-08-14). Data as JSON: /api/errors/a7791f5e05f0e91e. Report an issue: GitHub.