What causes "应用暂未开放此授权模式" in dromara/Sa-Token?

Add the grant type to the client's allowGrantTypes when registering the SaClientModel (e.g. Arrays.asList("authorization_code", "password", "client_credentials"))

dromara/Sa-Token · error · SaOAuth2Exception

30142

30142

Error message

应用暂未开放此授权模式

What it means

Thrown by throwErrorClientNotEnableModel() when the mode is enabled globally but the specific client is not allowed to use it: the client's registered allowGrantTypes list does not contain the requested grant type. Error code 30142.

Source

Thrown at sa-token-plugin/sa-token-oauth2/src/main/java/cn/dev33/satoken/oauth2/processor/SaOAuth2ServerProcessor.java:392

		}
		// 其它
		else {
			throw new SaOAuth2Exception("无效 response_type: " + responseType).setCode(SaOAuth2ErrorCode.CODE_30125);
		}
	}

	/**
	 * 系统未开放此授权模式时抛出异常
	 */
	public void throwErrorSystemNotEnableModel() {
		throw new SaOAuth2Exception("系统暂未开放此授权模式").setCode(SaOAuth2ErrorCode.CODE_30141);
	}

	/**
	 * 应用未开放此授权模式时抛出异常
	 */
	public void throwErrorClientNotEnableModel() {
		throw new SaOAuth2Exception("应用暂未开放此授权模式").setCode(SaOAuth2ErrorCode.CODE_30142);
	}

}

View on GitHub (pinned to ac2c7f6e94)

Solutions

Add the grant type to the client's allowGrantTypes when registering the SaClientModel (e.g. Arrays.asList("authorization_code", "password", "client_credentials"))
Verify the client record actually in use (right client_id, right environment/data loader) — not a stale duplicate
Ensure the mode is also enabled at server level, otherwise 30141 fires next

Example fix

// before
new SaClientModel().setClientId("1001")
    .setAllowGrantTypes(Arrays.asList("authorization_code"));

// after
new SaClientModel().setClientId("1001")
    .setAllowGrantTypes(Arrays.asList("authorization_code", "password", "client_credentials"));

Defensive patterns

Strategy: validation

Validate before calling

SaClientModel cm = oauth2Template.getClientModel(clientId);
if(cm == null || !cm.getAllowGrantTypes().contains(neededGrantType)) {
    throw new IllegalStateException("client not allowed to use " + neededGrantType);
}

Try / catch

catch(SaOAuth2Exception e) { if("30142".equals(e.getCode())) return 403 "client not permitted for this grant type"; }

Prevention

Keep allowGrantTypes in the client registry in sync with the integrations that use each client_id
Add a startup check that every client's allowGrantTypes is a subset of the globally enabled modes

When it happens

Trigger: A SaClientModel registered with allowGrantTypes=[authorization_code] receiving a password or client_credentials request; client record updated in the data store but the cached/duplicated registration still has the old list.

Common situations: Newly added integration reuses an existing client_id that was registered for web-server flow only; the client was provisioned via config copy-paste and allowGrantTypes was never widened; multi-instance deployments where only one node reloaded the client registry.

Related errors

AI-assisted analysis of dromara/Sa-Token@ac2c7f6e94 (2026-08-14). Data as JSON: /api/errors/eef00c0d30f31e8d. Report an issue: GitHub.