justauth/JustAuth · error · AuthException

5011

5011

Error message

Invalid token

What it means

AuthException with AuthResponseStatus.ILLEGAL_TOKEN (code 5011) thrown by AuthAmazonRequest.checkToken: it calls https://api.amazon.com/auth/o2/tokeninfo with the access token and requires the returned aud (audience) to equal config.getClientId(). A mismatch means the token was issued to a different client.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthAmazonRequest.java:171

        this.checkResponse(jsonObject);

        return AuthUser.builder()
            .rawUserInfo(jsonObject)
            .uuid(jsonObject.getString("user_id"))
            .username(jsonObject.getString("name"))
            .nickname(jsonObject.getString("name"))
            .email(jsonObject.getString("email"))
            .gender(AuthUserGender.UNKNOWN)
            .source(source.toString())
            .token(authToken)
            .build();
    }

    private void checkToken(String accessToken) {
        String tokenInfo = new HttpUtils(config.getHttpConfig()).get("https://api.amazon.com/auth/o2/tokeninfo?access_token=" + UrlUtil.urlEncode(accessToken)).getBody();
        JSONObject jsonObject = JSONObject.parseObject(tokenInfo);
        if (!config.getClientId().equals(jsonObject.getString("aud"))) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_TOKEN);
        }
    }

    @Override
    protected String userInfoUrl(AuthToken authToken) {
        return UrlBuilder.fromBaseUrl(source.userInfo())
            .queryParam("user_id", authToken.getUserId())
            .queryParam("screen_name", authToken.getScreenName())
            .queryParam("include_entities", true)
            .build();
    }
}

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Clear cached Amazon tokens and re-run the OAuth flow with the current clientId
2. Confirm only one security profile per environment and that the token store is keyed by clientId
3. Double-check clientId in AuthConfig against the LWA console

if (StringUtils.isEmpty(config.getClientId())) {
    throw new IllegalStateException("AMAZON clientId required for token audience check");
}
// before login: token cache must be keyed by clientId so foreign tokens are never replayed
assert tokenCache.keySet().contains(config.getClientId());

When it happens

Trigger: AuthAmazonRequest.getAccessToken (and hence login) with an access token minted for a different Amazon client id — e.g. tokens from a second security profile, another environment, or a stale token store keyed incorrectly.

Common situations: Shared token cache across dev/prod apps that use different client ids; security profile recreated after deletion and old tokens replayed; clientId typo so the comparison never matches.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• ${error_description} ${error_description}
• ${errMsg}
• 5008
• ${cause.message}
• ${subMsg}

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/7a4f458e453d617a. Report an issue: GitHub.