justauth/JustAuth · error · AuthException

5014

5014

Error message

Invalid client id

What it means

AuthException with AuthResponseStatus.ILLEGAL_CLIENT_ID (code 5014) from AuthAppleRequest.checkConfig: after the base config check, config.getClientId() is empty. For Apple, clientId must be the Services ID (e.g. com.yourapp.auth), not the App ID or team id.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthAppleRequest.java:99

        String[] idToken = authToken.getIdToken().split("\\.");
        String payload = new String(urlDecoder.decode(idToken[1]));
        JSONObject object = JSONObject.parseObject(payload);
        // https://developer.apple.com/documentation/sign_in_with_apple/sign_in_with_apple_rest_api/authenticating_users_with_sign_in_with_apple#3383773
        return AuthUser.builder()
            .rawUserInfo(object)
            .uuid(object.getString("sub"))
            .email(object.getString("email"))
            .username(authToken.getUsername())
            .token(authToken)
            .source(source.toString())
            .build();
    }

    @Override
    protected void checkConfig(AuthConfig config) {
        super.checkConfig(config);
        if (StringUtils.isEmpty(config.getClientId())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_CLIENT_ID, source);
        }
        if (StringUtils.isEmpty(config.getClientSecret())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_CLIENT_SECRET, source);
        }
        if (StringUtils.isEmpty(config.getKid())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_KID, source);
        }
        if (StringUtils.isEmpty(config.getTeamId())) {
            throw new AuthException(AuthResponseStatus.ILLEGAL_TEAM_ID, source);
        }
    }

    /**
     * 获取token
     * @see <a href="https://developer.apple.com/documentation/accountorganizationaldatasharing/creating-a-client-secret">creating-a-client-secret</a>
     * @return jwt token
     */
    private String getToken() {

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Set clientId to the Sign in with Apple Services ID created in the developer console
2. While configuring, also set kid (key id), teamId and the .p8 private key as clientSecret — the same check enforces them next
3. Log AuthConfig completeness at startup for the APPLE source to fail fast

Example fix

// before
AuthConfig.builder().redirectUri("https://x/callback").build();

// after
AuthConfig.builder()
    .clientId("com.yourapp.auth")      // Services ID
    .clientSecret("-----BEGIN PRIVATE KEY-----...") // .p8 content
    .kid("ABC123DEFG")
    .teamId("WXYZ1234AB")
    .redirectUri("https://x/callback").build();

if (StringUtils.isEmpty(config.getClientId())
    || StringUtils.isEmpty(config.getClientSecret())
    || StringUtils.isEmpty(config.getKid())
    || StringUtils.isEmpty(config.getTeamId())) {
    throw new IllegalStateException("APPLE requires clientId(Services ID), clientSecret(.p8 PEM), kid, teamId");
}

When it happens

Trigger: Instantiating AuthAppleRequest (directly or via AuthRequestBuilder with source APPLE) with an AuthConfig lacking clientId. checkConfig runs at construction, so the request never reaches Apple.

Common situations: Confusing Apple's identifiers: using the App ID/bundle id or team id where the Services ID belongs; placeholder config promoted to production; clientId read from an env var unset in the deploy environment.

Related errors

• 5015
• 5012
• 5013
• 5002
• 5006

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/0956bd919bc08b1a. Report an issue: GitHub.