justauth/JustAuth · error · AuthException

5002

5002

Error message

Parameter incomplete

What it means

AuthException with AuthResponseStatus.PARAMETER_INCOMPLETE (code 5002) thrown from AuthAlipayRequest.check when neither the constructor's alipayPublicKey argument nor config.getAlipayPublicKey() is non-empty. Alipay requires the platform's public key to verify gateway responses, so the request cannot be built.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthAlipayRequest.java:132

     * @see AuthAlipayRequest#AuthAlipayRequest(me.zhyd.oauth.config.AuthConfig, me.zhyd.oauth.cache.AuthStateCache, java.lang.String, java.lang.Integer)
     */
    public AuthAlipayRequest(AuthConfig config, String alipayPublicKey, AuthStateCache authStateCache, String proxyHost, Integer proxyPort) {
        super(config, AuthDefaultSource.ALIPAY, authStateCache);
        this.alipayPublicKey = determineAlipayPublicKey(alipayPublicKey, config);
        check(config);
        this.alipayClient = new DefaultAlipayClient(GATEWAY, config.getClientId(), config.getClientSecret(),
            "json", "UTF-8", this.alipayPublicKey, "RSA2", proxyHost, proxyPort);
    }

    private String determineAlipayPublicKey(String alipayPublicKey, AuthConfig config) {
        return alipayPublicKey != null ? alipayPublicKey : config.getAlipayPublicKey();
    }

    protected void check(AuthConfig config) {
        AuthChecker.checkConfig(config, AuthDefaultSource.ALIPAY);

        if (!StringUtils.isNotEmpty(alipayPublicKey)) {
            throw new AuthException(AuthResponseStatus.PARAMETER_INCOMPLETE, AuthDefaultSource.ALIPAY);
        }

        // 支付宝在创建回调地址时，不允许使用localhost或者127.0.0.1
        if (GlobalAuthUtils.isLocalHost(config.getRedirectUri())) {
            // The redirect uri of alipay is forbidden to use localhost or 127.0.0.1
            throw new AuthException(AuthResponseStatus.ILLEGAL_REDIRECT_URI, AuthDefaultSource.ALIPAY);
        }
    }

    @Override
    protected void checkCode(AuthCallback authCallback) {
        if (StringUtils.isEmpty(authCallback.getAuth_code())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_CODE, source);
        }
    }

    @Override
    public AuthToken getAccessToken(AuthCallback authCallback) {

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Set alipayPublicKey on the AuthConfig (the Alipay open-platform public key, not your app's private key) before constructing the request
2. If using certificate mode, build AuthAlipayCertRequest instead with app-cert, alipay-public-key-cert and root-cert paths
3. Verify the key survives environment promotion (dev/staging/prod) — log AuthConfig key presence at startup

Example fix

// before
AuthConfig config = AuthConfig.builder()
    .clientId(id).clientSecret(secret).redirectUri(uri).build();
new AuthAlipayRequest(config);

// after
AuthConfig config = AuthConfig.builder()
    .clientId(id).clientSecret(secret).redirectUri(uri)
    .alipayPublicKey("MIIBIjANBgkq...").build();
new AuthAlipayRequest(config);

if (StringUtils.isEmpty(config.getAlipayPublicKey())) {
    throw new IllegalStateException("ALIPAY requires alipayPublicKey in AuthConfig");
}

When it happens

Trigger: Building AuthAlipayRequest (or the via AuthRequestBuilder) with an AuthConfig that omits alipayPublicKey. AuthChecker.checkConfig already passed because clientId/clientSecret/redirectUri are present, but the Alipay-specific key check fails.

Common situations: Copying an AuthConfig from another provider's example and forgetting alipayPublicKey; storing the key in an env var that is not set in the deploy environment; accidentally passing the app's own private key under a different name and leaving alipayPublicKey blank.

Related errors

• 5006
• ${cause.message}
• 5008
• 5014
• 5015

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/15f2a60e39e3d3c9. Report an issue: GitHub.