justauth/JustAuth · error · AuthException

5013

5013

Error message

Invalid team id

What it means

AuthException with AuthResponseStatus.ILLEGAL_TEAM_ID (code 5013) from AuthAppleRequest.checkConfig: config.getTeamId() is empty. The team id is the JWT issuer claim when JustAuth builds the client secret (getToken() uses issuer(this.config.getTeamId())), and Apple validates it against the key's owning team.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthAppleRequest.java:108

            .token(authToken)
            .source(source.toString())
            .build();
    }

    @Override
    protected void checkConfig(AuthConfig config) {
        super.checkConfig(config);
        if (StringUtils.isEmpty(config.getClientId())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_CLIENT_ID, source);
        }
        if (StringUtils.isEmpty(config.getClientSecret())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_CLIENT_SECRET, source);
        }
        if (StringUtils.isEmpty(config.getKid())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_KID, source);
        }
        if (StringUtils.isEmpty(config.getTeamId())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_TEAM_ID, source);
        }
    }

    /**
     * 获取token
     * @see <a href="https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret">creating-a-client-secret</a>
     * @return jwt token
     */
    private String getToken() {
        return Jwts.builder().header().add(AbstractJwk.KID.getId(), this.config.getKid()).and()
            .issuer(this.config.getTeamId())
            .subject(this.config.getClientId())
            .audience().add(AUD).and()
            .expiration(new Date(System.currentTimeMillis() + TimeUnit.MINUTES.toMillis(3)))
            .issuedAt(new Date())
            .signWith(getPrivateKey())
            .compact();
    }

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Set teamId to the 10-character Membership/Team ID from the Apple developer console (top-right of the console)
2. After a team/organization change, refresh teamId, kid and the .p8 together and re-verify
3. Add a startup assertion that all four Apple fields are present for the APPLE source

Example fix

// before
AuthConfig.builder().clientId("com.yourapp.auth").kid("ABC123DEFG").build();

// after
AuthConfig.builder()
    .clientId("com.yourapp.auth")
    .kid("ABC123DEFG")
    .teamId("WXYZ1234AB")...

if (StringUtils.isEmpty(config.getTeamId()) || !config.getTeamId().matches("[A-Z0-9]{10}")) {
    throw new IllegalStateException("APPLE teamId must be the 10-char Membership Team ID");
}

When it happens

Trigger: Constructing AuthAppleRequest without teamId in AuthConfig. This is the last of the four Apple-specific config checks (clientId, clientSecret, kid, teamId).

Common situations: teamId omitted because other providers do not need it; membership in the Apple Developer Program transferred so the team id changed; multi-team orgs using the wrong 10-character team id.

Related errors

• 5014
• 5015
• 5012
• 5002
• 5006

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/e47eda927a3a4a0f. Report an issue: GitHub.