jeecgboot/JeecgBoot · error · JeecgBootException

该appKey未授权当前接口

Error message

该appKey未授权当前接口

What it means

Thrown by checkPermission when none of the OpenApiPermission rows linked to the auth account (openApiAuth.id) reference the requested API (openApi.id). After signature validation passes, this enforces per-API authorization: the appkey must be explicitly granted the specific interface it is calling.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/filter/ApiAuthFilter.java:247

        if (!signature.equals(md5(appKey + openApiAuth.getSk() + timestamp))) {
            throw new JeecgBootException("signature签名错误");
        }
    }

    protected void checkPermission(OpenApi openApi, OpenApiAuth openApiAuth) {
        List<OpenApiPermission> permissionList = openApiPermissionService.findByAuthId(openApiAuth.getId());

        boolean hasPermission = false;
        for (OpenApiPermission permission : permissionList) {
            if (permission.getApiId().equals(openApi.getId())) {
                hasPermission = true;
                break;
            }
        }

        if (!hasPermission) {
            throw new JeecgBootException("该appKey未授权当前接口");
        }
    }

    /**
     * @return String    返回类型
     * @Title: MD5
     * @Description: 【MD5加密】
     */
    protected static String md5(String sourceStr) {
        String result = "";
        try {
            MessageDigest md = MessageDigest.getInstance("MD5");
            md.update(sourceStr.getBytes("utf-8"));
            byte[] hash = md.digest();
            int i;
            StringBuffer buf = new StringBuffer(32);
            for (int offset = 0; offset < hash.length; offset++) {
                i = hash[offset];

View on GitHub (pinned to 96fb33f5ec)

Solutions

1. In the admin UI, add an OpenApiPermission entry linking the auth account to the requested OpenApi record.
2. Verify the api_id on the permission row matches openApi.getId() exactly.
3. Confirm the permission row is not soft-deleted or filtered out by findByAuthId.

Example fix

// before: open_api_permission has no row for (auth_id=A, api_id=42)
// after:  INSERT INTO open_api_permission(auth_id, api_id) VALUES ('A','42');

// Verify permission exists before exposing the API to the caller (admin side)
boolean granted = openApiPermissionService.findByAuthId(authId).stream()
    .anyMatch(p -> p.getApiId().equals(apiId));
if (!granted) { /* grant via admin before the call */ }

try {
    openApi.call(...);
} catch (JeecgBootException e) {
    if (e.getMessage().contains("未授权当前接口")) {
        // request permission grant; do not retry until granted
    }
}

When it happens

Trigger: The caller authenticated correctly but the OpenApiAuth account has no OpenApiPermission row for this API; the permission row was revoked; the api_id on the permission row does not match the openApi row being called.

Common situations: New partner given credentials but not granted the specific API; permission revoked during an audit but client still calling; API was re-created with a new id and old permissions dangle.

Related errors

• IP[{ip}]不在白名单中，禁止访问
• appkey为空
• signature为空
• timastamp时间戳为空
• timastamp时间戳不合法

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/5ddac080ec0bb383. Report an issue: GitHub.