justauth/JustAuth · error · AuthException

${errmsg}

Error message

${errmsg}

What it means

AbstractAuthWeChatEnterpriseRequest.checkResponse parses every WeChat Work (企业微信) API response and, when errcode is present and non-zero, throws AuthException carrying WeChat's errmsg (with the source attached). This is the pass-through of WeChat Work's native error envelope, covering token, user-info, and user-detail calls.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AbstractAuthWeChatEnterpriseRequest.java:86

            .email(userDetail.getString("email"))
            .uuid(userId)
            .gender(AuthUserGender.getWechatRealGender(userDetail.getString("gender")))
            .token(authToken)
            .source(source.toString())
            .build();
    }

    /**
     * 校验请求结果
     *
     * @param response 请求结果
     * @return 如果请求结果正常，则返回JSONObject
     */
    private JSONObject checkResponse(String response) {
        JSONObject object = JSONObject.parseObject(response);

        if (object.containsKey("errcode") && object.getIntValue("errcode") != 0) {
            throw new AuthException(object.getString("errmsg"), source);
        }

        return object;
    }


    /**
     * 返回获取accessToken的url
     *
     * @param code 授权码
     * @return 返回获取accessToken的url
     */
    @Override
    protected String accessTokenUrl(String code) {
        return UrlBuilder.fromBaseUrl(source.accessToken())
            .queryParam("corpid", config.getClientId())
            .queryParam("corpsecret", config.getClientSecret())
            .build();

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Log the numeric errcode with the message — WeChat Work's error-code reference pinpoints the exact cause (40014/42001 = token expired, 40029 = bad code, 60020 = IP not trusted).
2. Ensure corpId, agentId (secret's app) and secret in AuthConfig come from the same self-built app, and the callback code was issued to that app.
3. Add the server egress IP to the app's trusted IP list in the WeChat Work admin console.
4. For token-expiry errors, re-run getAccessToken before retrying the user-info call once.

Example fix

// before
// token cached indefinitely; after 2h WeChat returns errcode 42001 -> errmsg exception

// after
try { return request.getUserInfo(token); }
catch (AuthException e) {
    if (e.getMessage() != null && e.getMessage().contains("42001")) {
        AuthToken fresh = request.getAccessToken(callback); // then retry once
        return request.getUserInfo(fresh);
    }
    throw e;
}

try { return request.getUserInfo(token); } catch (AuthException e) { String m = String.valueOf(e.getMessage()); if (m.contains("42001") || m.contains("40014")) { AuthToken fresh = request.getAccessToken(callback); return request.getUserInfo(fresh); } throw e; }

When it happens

Trigger: Expired or invalid access_token (errcode 40014/42001) when calling getAccessToken/getUserInfo; wrong corpId/secret producing 40001 invalid credential; invalid code (40029) from a mismatched agentId or reused code; API calls where the IP is not in the trusted list (60020).

Common situations: Access tokens cached too long and used after their 7200s expiry; secret rotated in the WeChat Work admin console but not in AuthConfig; server IP not whitelisted under the app's IP trust configuration; agentId from a different app than the secret.

Related errors

• ${errmsg}
• ${errmsg}
• ${error_description}
• 5005
• ${subMsg}

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/fe5113ebfddbdc59. Report an issue: GitHub.