iflytek/astron-agent · error · AesException

-40004

-40004

Error message

Illegal AES key

What it means

WXBizMsgCrypt validates the WeChat callback encodingAesKey before use: it must be exactly 43 Base64 characters (decoding, with one '=' pad, to a 32-byte AES-256 key). If the length differs it throws AesException with code -40004 (IllegalAesKey).

Solutions

1. Copy the EncodingAESKey (exactly 43 chars) from the WeChat official account/console config and re-deploy
2. Trim the value at load time: key = rawKey.trim(), and ensure config storage isn't adding whitespace or quotes
3. Verify length == 43 before constructing WXBizMsgCrypt
4. Confirm you are not confusing AppSecret (32 hex chars) with EncodingAESKey

Example fix

// before
WXBizMsgCrypt crypt = new WXBizMsgCrypt(token, appSecret, appId); // -40004
// after
String aesKey = config.getEncodingAesKey().trim();
if (aesKey.length() != 43) {
    throw new IllegalStateException("EncodingAESKey must be exactly 43 chars, got " + aesKey.length());
}
WXBizMsgCrypt crypt = new WXBizMsgCrypt(token, aesKey, appId);

if (aesKey == null || aesKey.trim().length() != 43) { throw new IllegalStateException("encodingAesKey must be exactly 43 chars"); }

try { new WXBizMsgCrypt(token, aesKey, appId); } catch (AesException e) { if (e.getCode() == -40004) { throw new ConfigurationException("invalid EncodingAESKey: must be 43 base64 chars"); } throw e; }

When it happens

Trigger: Constructing WXBizMsgCrypt with a token/AES key taken from the wrong WeChat app, a key with leading/trailing whitespace or newline, a truncated or hand-retyped key, or passing the AppSecret instead of the EncodingAESKey.

Common situations: Copy-paste from the WeChat MP console dropping/gaining characters, storing the key in config with quotes or trailing spaces, rotating apps and forgetting to update the key, or using the 32-char AppSecret by mistake.

Understand the failure class

Background: "Invalid value" and "allowed values are" config errors: what your library rejected and how to fix it — this error's family across 41 libraries.

Related errors

• -40006
• -40007
• -40008
• BOT_NOT_EXISTS
• PARAMS_ERROR

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/1b3bb62b7b329cd4. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/hub/src/main/java/com/iflytek/astron/console/hub/util/wechat/WXBizMsgCrypt.java:57

    public WXBizMsgCrypt(String token, String encodingAesKey, String appId) throws AesException {
        this(token, validateAndDecodeAesKey(encodingAesKey), appId);
    }

    /**
     * Private constructor that doesn't throw exceptions
     */
    private WXBizMsgCrypt(String token, byte[] aesKey, String appId) {
        this.token = token;
        this.aesKey = aesKey;
        this.appId = appId;
    }

    /**
     * Validate and decode AES key
     */
    private static byte[] validateAndDecodeAesKey(String encodingAesKey) throws AesException {
        if (encodingAesKey.length() != 43) {
            throw new AesException(AesException.IllegalAesKey);
        }
        return Base64.decodeBase64(encodingAesKey + "=");
    }

    // Generate 4-byte network byte order
    byte[] getNetworkBytesOrder(int sourceNumber) {
        byte[] orderBytes = new byte[4];
        orderBytes[3] = (byte) (sourceNumber & 0xFF);
        orderBytes[2] = (byte) (sourceNumber >> 8 & 0xFF);
        orderBytes[1] = (byte) (sourceNumber >> 16 & 0xFF);
        orderBytes[0] = (byte) (sourceNumber >> 24 & 0xFF);
        return orderBytes;
    }

    // Restore 4-byte network byte order
    int recoverNetworkBytesOrder(byte[] orderBytes) {
        int sourceNumber = 0;
        for (int i = 0; i < 4; i++) {

View on GitHub (pinned to 5e758547a8)