justauth/JustAuth · error · AuthException

accessTokenObject.get("msg")

Error message

accessTokenObject.get("msg")

What it means

AuthQqRequest.getAuthToken throws AuthException with the 'msg' field when the token-endpoint response (parsed as a URL-encoded query string, not JSON) lacks access_token or contains a 'code' key. QQ signals grant failures via code/msg pairs in the query string.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthQqRequest.java:118

    /**
     * 返回获取userInfo的url
     *
     * @param authToken 用户授权token
     * @return 返回获取userInfo的url
     */
    @Override
    protected String userInfoUrl(AuthToken authToken) {
        return UrlBuilder.fromBaseUrl(source.userInfo())
            .queryParam("access_token", authToken.getAccessToken())
            .queryParam("oauth_consumer_key", config.getClientId())
            .queryParam("openid", authToken.getOpenId())
            .build();
    }

    private AuthToken getAuthToken(String response) {
        Map<String, String> accessTokenObject = GlobalAuthUtils.parseStringToMap(response);
        if (!accessTokenObject.containsKey("access_token") || accessTokenObject.containsKey("code")) {
            throw new AuthException(accessTokenObject.get("msg"));
        }
        return AuthToken.builder()
            .accessToken(accessTokenObject.get("access_token"))
            .expireIn(Integer.parseInt(accessTokenObject.getOrDefault("expires_in", "0")))
            .refreshToken(accessTokenObject.get("refresh_token"))
            .build();
    }

    @Override
    public String authorize(String state) {
        return UrlBuilder.fromBaseUrl(super.authorize(state))
            .queryParam("scope", this.getScopes(",", false, AuthScopeUtils.getDefaultScopes(AuthQqScope.values())))
            .build();
    }
}

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Decode the msg value (URL-encoded Chinese message) — it names the exact QQ error (e.g. clientid非法, redirect uri非法)
2. Ensure redirectUri in AuthConfig exactly equals the registered callback (QQ requires exact match)
3. Verify QQ Connect app审核 status: unapproved apps only work for the developer's own QQ number (code 100010 style errors)
4. Test login with the developer QQ account first if the app is pending review

Example fix

null

null

null

try {
    qqRequest.getAuthResponse(callback);
} catch (AuthException e) {
    // message is QQ's msg param; URL-decode it for the Chinese reason (e.g. redirect uri非法)
    log.warn("QQ grant error: {}", java.net.URLDecoder.decode(String.valueOf(e.getMessage()), java.nio.charset.StandardCharsets.UTF_8));
}

When it happens

Trigger: getAccessToken or refresh when QQ returns e.g. ?code=100005&msg=clientid非法 or code=100009 (redirect uri format illegal) instead of an access_token.

Common situations: Wrong clientid/clientsecret, redirect_uri not exactly matching the one registered in QQ Connect (must be the callback domain registered, down to path), or the PC-vs-WAP callback URL confusion for QQ interconnect.

Related errors

• object.getString("msg")
• object.get("error") + ":" + object.get("error_description")
• object.getString("error_description") / object.getString("er
• object.getString("msg")
• 5002

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/ed42902f0454e912. Report an issue: GitHub.