What causes "Parameter incomplete" in justauth/JustAuth?

Populate all required AuthConfig fields: AuthConfig.builder().clientId(..).clientSecret(..).redirectUri(..).build().

justauth/JustAuth · error · AuthException

5002

5002

Error message

Parameter incomplete

What it means

This is a local configuration failure thrown from the AuthDefaultRequest constructor (AuthDefaultRequest.java:40): before any network call, JustAuth runs AuthChecker.isSupportedAuth(config, source) and rejects the request with code 5002 (PARAMETER_INCOMPLETE) when the AuthConfig is missing fields the given provider requires (typically clientId, clientSecret, redirectUri). It is thrown synchronously at object construction time.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthDefaultRequest.java:40

 * @author yadong.zhang (yadong.zhang0415(a)gmail.com)
 * @author yangkai.shen (https://xkcoding.com)
 * @since 1.0.0
 */
public abstract class AuthDefaultRequest implements AuthRequest {
    protected AuthConfig config;
    protected AuthSource source;
    protected AuthStateCache authStateCache;

    public AuthDefaultRequest(AuthConfig config, AuthSource source) {
        this(config, source, AuthDefaultStateCache.INSTANCE);
    }

    public AuthDefaultRequest(AuthConfig config, AuthSource source, AuthStateCache authStateCache) {
        this.config = config;
        this.source = source;
        this.authStateCache = authStateCache;
        if (!AuthChecker.isSupportedAuth(config, source)) {
            throw new AuthException(AuthResponseStatus.PARAMETER_INCOMPLETE, source);
        }
        // 校验配置合法性
        this.checkConfig(config);
    }

    /**
     * 统一的登录入口。当通过{@link AuthDefaultRequest#authorize(String)}授权成功后，会跳转到调用方的相关回调方法中
     * 方法的入参可以使用{@code AuthCallback}，{@code AuthCallback}类中封装好了OAuth2授权回调所需要的参数
     *
     * @param authCallback 用于接收回调参数的实体
     * @return AuthResponse
     */
    @Override
    public AuthResponse<AuthUser> login(AuthCallback authCallback) {
        try {
            checkCode(authCallback);
            if (!config.isIgnoreCheckState()) {
                AuthChecker.checkState(authCallback.getState(), source, authStateCache);

View on GitHub (pinned to 694bbf1b01)

Solutions

Populate all required AuthConfig fields: AuthConfig.builder().clientId(..).clientSecret(..).redirectUri(..).build().
If config comes from env/properties, fail startup fast with a clear message when any of the three values is blank.
For custom AuthSource implementations, make sure authorize/accessToken/userInfo/refresh URLs are all set - AuthChecker also validates the source's endpoint definitions.
Catch AuthException around request construction and check ErrorCodeEnum.fromCode(5002) to distinguish config errors from API errors.

Example fix

// before
AuthConfig config = AuthConfig.builder().clientId(clientId).build(); // secret + redirectUri missing
AuthRequest request = new AuthBaiduRequest(config, AuthDefaultSource.BAIDU); // throws 5002

// after
AuthConfig config = AuthConfig.builder()
    .clientId(clientId)
    .clientSecret(clientSecret)
    .redirectUri(redirectUri)
    .build();
AuthRequest request = new AuthBaiduRequest(config, AuthDefaultSource.BAIDU);

Defensive patterns

Strategy: validation

Validate before calling

// Validate before constructing any AuthRequest
public AuthConfig requireValidConfig(String clientId, String clientSecret, String redirectUri) {
    if (isBlank(clientId) || isBlank(clientSecret) || isBlank(redirectUri)) {
        throw new IllegalStateException("OAuth config incomplete: clientId/clientSecret/redirectUri must all be set");
    }
    return AuthConfig.builder().clientId(clientId).clientSecret(clientSecret).redirectUri(redirectUri).build();
}

Try / catch

try {
    return new AuthBaiduRequest(config, AuthDefaultSource.BAIDU);
} catch (AuthException e) {
    if (e.getErrorCode() == 5002) {
        throw new ConfigurationException("OAuth provider config incomplete - check env vars", e);
    }
    throw e;
}

Prevention

Fail fast at application startup: assert all OAuth config fields are present before serving traffic.
Use a startup checklist per environment (dev/staging/prod) so missing env vars are caught by health checks, not user logins.
Add a config unit test that builds every AuthRequest you use - it will throw 5002 immediately if a field is missing.

When it happens

Trigger: Constructing any AuthXxxRequest (e.g. new AuthBaiduRequest(config, AuthDefaultSource.BAIDU)) where config.getClientId(), getClientSecret() or getRedirectUri() is null/blank; also when a custom AuthSource does not declare required endpoints.

Common situations: Loading OAuth credentials from environment variables or a properties file that is empty in a deployed environment, forgetting to call builder methods on AuthConfig, or injecting an autowired AuthConfig bean whose fields were never populated in the active Spring profile.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/4f617965c3f6929a. Report an issue: GitHub.