justauth/JustAuth · error · AuthException

${AuthToutiaoErrorCode.getErrorCode(error_code).getDesc()}

Error message

${AuthToutiaoErrorCode.getErrorCode(error_code).getDesc()}

What it means

AuthToutiaoRequest.checkResponse throws AuthException when the response contains `error_code`; the message is the human description obtained by mapping the numeric code through AuthToutiaoErrorCode.getErrorCode(code).getDesc(). So the thrown text is a JustAuth-local, friendly description of the Toutiao (ByteDance) error code, not the raw server text.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthToutiaoRequest.java:127

     * @param authToken 用户授权后的token
     * @return 返回获取userInfo的url
     */
    @Override
    protected String userInfoUrl(AuthToken authToken) {
        return UrlBuilder.fromBaseUrl(source.userInfo())
            .queryParam("client_key", config.getClientId())
            .queryParam("access_token", authToken.getAccessToken())
            .build();
    }

    /**
     * 检查响应内容是否正确
     *
     * @param object 请求响应内容
     */
    private void checkResponse(JSONObject object) {
        if (object.containsKey("error_code")) {
            throw new AuthException(AuthToutiaoErrorCode.getErrorCode(object.getIntValue("error_code")).getDesc());
        }
    }
}

View on GitHub (pinned to 694bbf1b01)

Solutions

Match the description against AuthToutiaoErrorCode entries (e.g. 'code 已被使用' / 'access_token 过期') to identify which token/code is at fault.
Guarantee single use of the authorization code: dedupe callback requests by code value before calling getAccessToken.
Re-run authorize(state) and re-consent when access_token has expired — Toutiao tokens are short-lived.
Verify client_key/client_secret and the applied-for scopes in the Toutiao open platform console.

Defensive patterns

Strategy: try-catch

Validate before calling

// dedupe the callback code before exchange (Toutiao codes are single-use, ~5 min)
if (!seenCodes.putIfAbsent(callback.getCode(), true)) {
    return cachedUserFor(callback.getCode()); // or 409
}

Try / catch

try {
    AuthUser u = toutiaoRequest.getUserInfo(token);
} catch (AuthException e) {
    log.warn("Toutiao error: {}", e.getMessage()); // description from AuthToutiaoErrorCode
    redirect(toutiaoRequest.authorize(freshState())); // code/token expired → re-consent
}

Prevention

Make the OAuth callback idempotent keyed on the code parameter.
Store token expiry and re-auth before access_token lapses (short-lived).
Keep client_key/secret in env config and rotate during maintenance windows.

When it happens

Trigger: Toutiao/Douyin open-platform API calls failing: getAccessToken with an invalid or expired authorization code (code already used), getUserInfo with an expired access_token, or wrong client_key/client_secret in AuthConfig.

Common situations: Authorization code older than ~5 minutes or exchanged twice (double callback); app credentials rotated on the open platform; access token past its 24h-ish validity being reused; missing approved scope for the user-info API.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/7ab6911a23c57650. Report an issue: GitHub.