iflytek/astron-agent · error

tenant verify app auth request failed, status=

Error message

tenant verify app auth request failed, status={}

What it means

verify() sends the credential-verification POST to the tenant service; when the HTTP response status is not 2xx (response.isSuccessful() false), it logs "tenant verify app auth request failed, status={}" with the status code and returns Optional.empty(). The credentials are treated as unverified; the tenant service explicitly rejected or errored on the request.

Solutions

  1. Read the logged status code and check tenant service logs for the matching request.
  2. Confirm the verify-app-auth URL path matches the tenant service's current API.
  3. Re-sync the internal API key between console backend and tenant service (rotation drift).
  4. Test credentials directly: curl -H internal-key -d '{api_key,api_secret}' <verify-url>.

Example fix

// before
if (!response.isSuccessful()) { log.warn(...); return Optional.empty(); }
// after
if (!response.isSuccessful()) {
    log.warn("tenant verify app auth request failed, status={}, body={}", response.code(), safeBody(response));
    if (response.code() >= 500) throw new IllegalStateException("tenant verify unavailable");
    return Optional.empty();
}
Defensive patterns

Strategy: try-catch

Validate before calling

// pre-flight connectivity
Response ping = httpClient.newCall(headRequest(verifyAppAuthUrl)).execute();
if (ping.code() == 404) throw new IllegalStateException("verify-app-auth path wrong");

Try / catch

Optional<String> appId = authClient.verify(apiKey, apiSecret);
if (appId.isEmpty()) {
    // inspect logs for "status={}"; distinguish 4xx (bad creds/key) from 5xx (tenant outage)
    metrics.increment("tenant.verify.failed", "outcome", "http-status");
}

Prevention

When it happens

Trigger: Tenant verify-app-auth endpoint returns 401 (bad internal key), 403, 404 (wrong path), 500 (tenant service error), or any non-success status for the given apiKey/apiSecret.

Common situations: Wrong verifyAppAuthUrl path after service rename; internal key mismatch after rotation; tenant service down behind a proxy returning 502/503; app credentials revoked on the tenant side.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

AI-assisted analysis of iflytek/astron-agent@5e758547a8 (2026-09-12). Data as JSON: /api/errors/f60112d19ef3dc94. Report an issue: GitHub.

Appendix: source

Thrown at console/backend/hub/src/main/java/com/iflytek/astron/console/hub/service/gateway/impl/HttpTenantGatewayAuthClient.java:75

                    TenantInternalApiKey.requireConfigured(tenantInternalKey);
        } catch (IllegalStateException exception) {
            log.warn("Tenant internal authentication is not configured; verification was not sent");
            return Optional.empty();
        }

        JSONObject requestBody = new JSONObject();
        requestBody.put("api_key", apiKey);
        requestBody.put("api_secret", apiSecret);

        Request request = new Request.Builder()
                .url(verifyAppAuthUrl)
                .header(TenantInternalApiKey.HEADER, configuredInternalKey)
                .post(RequestBody.create(requestBody.toJSONString(), JSON_MEDIA_TYPE))
                .build();

        try (Response response = httpClient.newCall(request).execute()) {
            if (!response.isSuccessful()) {
                log.warn("tenant verify app auth request failed, status={}", response.code());
                return Optional.empty();
            }
            return parseAppId(response.body());
        } catch (IOException | RuntimeException ex) {
            log.warn(
                    "Tenant application credential verification request failed: {}",
                    ex.getClass().getSimpleName());
            return Optional.empty();
        }
    }

    private Optional<String> parseAppId(ResponseBody body) throws IOException {
        if (body == null) {
            return Optional.empty();
        }
        JSONObject responseJson = JSON.parseObject(body.string());
        Integer code = responseJson == null ? null : responseJson.getInteger("code");
        if (code == null || code != 0) {

View on GitHub (pinned to 5e758547a8)