justauth/JustAuth · error · AuthException

5012

5012

Error message

Invalid key identifier(kid)

What it means

AuthException with AuthResponseStatus.ILLEGAL_KID (code 5012) from AuthAppleRequest.checkConfig: config.getKid() is empty. The kid (key identifier) is embedded as the JWT header when JustAuth mints the client-secret JWT in getToken(), and Apple rejects secrets without it.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthAppleRequest.java:105

            .uuid(object.getString("sub"))
            .email(object.getString("email"))
            .username(authToken.getUsername())
            .token(authToken)
            .source(source.toString())
            .build();
    }

    @Override
    protected void checkConfig(AuthConfig config) {
        super.checkConfig(config);
        if (StringUtils.isEmpty(config.getClientId())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_CLIENT_ID, source);
        }
        if (StringUtils.isEmpty(config.getClientSecret())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_CLIENT_SECRET, source);
        }
        if (StringUtils.isEmpty(config.getKid())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_KID, source);
        }
        if (StringUtils.isEmpty(config.getTeamId())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_TEAM_ID, source);
        }
    }

    /**
     * 获取token
     * @see <a href="https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret">creating-a-client-secret</a>
     * @return jwt token
     */
    private String getToken() {
        return Jwts.builder().header().add(AbstractJwk.KID.getId(), this.config.getKid()).and()
            .issuer(this.config.getTeamId())
            .subject(this.config.getClientId())
            .audience().add(AUD).and()
            .expiration(new Date(System.currentTimeMillis() + TimeUnit.MINUTES.toMillis(3)))
            .issuedAt(new Date())

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Set kid to the 10-character Key ID shown next to the Sign in with Apple key in the Apple developer console
2. Keep kid, teamId, .p8 secret and Services ID together in one config unit so they cannot drift apart
3. If the key was regenerated, update kid and the .p8 content simultaneously

Example fix

// before
AuthConfig.builder().clientId("com.yourapp.auth").build();

// after
AuthConfig.builder()
    .clientId("com.yourapp.auth")
    .kid("ABC123DEFG")
    .teamId("WXYZ1234AB")...

if (StringUtils.isEmpty(config.getKid()) || !config.getKid().matches("[A-Z0-9]{10}")) {
    throw new IllegalStateException("APPLE kid must be the 10-char Key ID from the developer console");
}

When it happens

Trigger: Building AuthAppleRequest with no kid in AuthConfig. Even before this throws, Apple would fail token requests; JustAuth fails fast at construction.

Common situations: kid confused with teamId or Services ID; key revoked in the console and config regenerated minus kid; kid exists in a secret store not wired to this service.

Related errors

• 5014
• 5015
• 5013
• 5002
• 5006

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/a3409bfa1664f355. Report an issue: GitHub.