jeecgboot/JeecgBoot · error · JeecgBootException

不存在认证信息

Error message

不存在认证信息

What it means

Thrown by checkSignature when the OpenApiAuth record looked up for the supplied appKey is null - meaning no credential row exists in the open_api_auth table for that appkey. This fires before the appkey-equality and MD5 checks, so it indicates the appkey itself is unknown to the system.

Source

Thrown at jeecg-boot/jeecg-module-system/jeecg-system-biz/src/main/java/org/jeecg/modules/openapi/filter/ApiAuthFilter.java:223

            throw new JeecgBootException("timastamp时间戳不合法");
        }
        if (System.currentTimeMillis() - Long.parseLong(timestamp) > 5 * 60 * 1000) {
            throw new JeecgBootException("signature签名已过期(超过五分钟)");
        }
    }

    /**
     * 认证信息核验
     * @param appKey
     * @param signature
     * @param timestamp
     * @param openApiAuth
     * @return
     * @throws Exception
     */
    protected void checkSignature(String appKey, String signature, String timestamp, OpenApiAuth openApiAuth) {
        if(openApiAuth==null){
            throw new JeecgBootException("不存在认证信息");
        }

        if(!appKey.equals(openApiAuth.getAk())){
            throw new JeecgBootException("appkey错误");
        }

        if (!signature.equals(md5(appKey + openApiAuth.getSk() + timestamp))) {
            throw new JeecgBootException("signature签名错误");
        }
    }

    protected void checkPermission(OpenApi openApi, OpenApiAuth openApiAuth) {
        List<OpenApiPermission> permissionList = openApiPermissionService.findByAuthId(openApiAuth.getId());

        boolean hasPermission = false;
        for (OpenApiPermission permission : permissionList) {
            if (permission.getApiId().equals(openApi.getId())) {
                hasPermission = true;

View on GitHub (pinned to 96fb33f5ec)

Solutions

  1. Provision an OpenApiAuth row for the appkey in the admin UI / open_api_auth table.
  2. Confirm the appkey has no logical-delete flag and matches exactly (trim whitespace).
  3. In microservice mode, ensure the open_api_auth data is accessible to the service handling the call.

Example fix

// before: appkey='ak_unknown' has no row in open_api_auth
// after:  INSERT a row with ak='ak_unknown', sk='<secret>' via the admin console
Defensive patterns

Strategy: try-catch

Validate before calling

// Before relying on an appkey, verify it is provisioned (requires admin API)
boolean known = openApiAuthAdminService.existsByAk(appkey);
if (!known) { /* provision or fail fast */ }

Try / catch

try {
    openApi.call(...);
} catch (JeecgBootException e) {
    if (e.getMessage().contains("不存在认证信息")) {
        // appkey not registered -> provision it, do not retry with the same value
    }
}

Prevention

When it happens

Trigger: Caller sends an appkey that was never provisioned, was deleted, or whose record is in a different datasource/tenant; lookup service returned null due to a soft-delete or status filter.

Common situations: New partner not yet registered; appkey revoked but client still calling; multi-tenant or microservice mode where the auth table is not replicated to the queried service.

Related errors

AI-assisted analysis of jeecgboot/JeecgBoot@96fb33f5ec (2026-08-14). Data as JSON: /api/errors/f9f006f00de45b2e. Report an issue: GitHub.