justauth/JustAuth · error · AuthException

5013

5013

Error message

Invalid team id

What it means

AuthException with AuthResponseStatus.ILLEGAL_TEAM_ID (code 5013) from AuthAppleRequest.checkConfig: config.getTeamId() is empty. The team id is the JWT issuer claim when JustAuth builds the client secret (getToken() uses issuer(this.config.getTeamId())), and Apple validates it against the key's owning team.

Solutions

1. Set teamId to the 10-character Membership/Team ID from the Apple developer console (top-right of the console)
2. After a team/organization change, refresh teamId, kid and the .p8 together and re-verify
3. Add a startup assertion that all four Apple fields are present for the APPLE source

Example fix

// before
AuthConfig.builder().clientId("com.yourapp.auth").kid("ABC123DEFG").build();

// after
AuthConfig.builder()
    .clientId("com.yourapp.auth")
    .kid("ABC123DEFG")
    .teamId("WXYZ1234AB")...

if (StringUtils.isEmpty(config.getTeamId()) || !config.getTeamId().matches("[A-Z0-9]{10}")) {
    throw new IllegalStateException("APPLE teamId must be the 10-char Membership Team ID");
}

When it happens

Trigger: Constructing AuthAppleRequest without teamId in AuthConfig. This is the last of the four Apple-specific config checks (clientId, clientSecret, kid, teamId).

Common situations: teamId omitted because other providers do not need it; membership in the Apple Developer Program transferred so the team id changed; multi-team orgs using the wrong 10-character team id.

Related errors

• 5012
• 5014
• 5015
• 5002
• 5006

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/e47eda927a3a4a0f. Report an issue: GitHub.

Appendix: source

Thrown at src/main/java/me/zhyd/oauth/request/AuthAppleRequest.java:108

            .token(authToken)
            .source(source.toString())
            .build();
    }

    @Override
    protected void checkConfig(AuthConfig config) {
        super.checkConfig(config);
        if (StringUtils.isEmpty(config.getClientId())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_CLIENT_ID, source);
        }
        if (StringUtils.isEmpty(config.getClientSecret())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_CLIENT_SECRET, source);
        }
        if (StringUtils.isEmpty(config.getKid())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_KID, source);
        }
        if (StringUtils.isEmpty(config.getTeamId())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_TEAM_ID, source);
        }
    }

    /**
     * 获取token
     * @see <a href="https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret">creating-a-client-secret</a>
     * @return jwt token
     */
    private String getToken() {
        return Jwts.builder().header().add(AbstractJwk.KID.getId(), this.config.getKid()).and()
            .issuer(this.config.getTeamId())
            .subject(this.config.getClientId())
            .audience().add(AUD).and()
            .expiration(new Date(System.currentTimeMillis() + TimeUnit.MINUTES.toMillis(3)))
            .issuedAt(new Date())
            .signWith(getPrivateKey())
            .compact();
    }

View on GitHub (pinned to 694bbf1b01)