justauth/JustAuth · error · AuthException

${error_description} ${error_description}

Error message

${error_description} ${error_description}

What it means

Thrown by AuthAmazonRequest.checkResponse when the token-endpoint JSON contains an 'error' key. The message concatenates error_description with itself — a copy-paste bug: the first term should have been jsonObject.getString("error") (the error code). Expect the human-readable description twice instead of 'code: description'.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthAmazonRequest.java:133

        String response = new HttpUtils(config.getHttpConfig()).post(url, param, httpHeader, false).getBody();
        JSONObject jsonObject = JSONObject.parseObject(response);
        this.checkResponse(jsonObject);
        return AuthToken.builder()
            .accessToken(jsonObject.getString("access_token"))
            .tokenType(jsonObject.getString("token_type"))
            .expireIn(jsonObject.getIntValue("expires_in"))
            .refreshToken(jsonObject.getString("refresh_token"))
            .build();
    }

    /**
     * 校验响应内容是否正确
     *
     * @param jsonObject 响应内容
     */
    private void checkResponse(JSONObject jsonObject) {
        if (jsonObject.containsKey("error")) {
            throw new AuthException(jsonObject.getString("error_description").concat(" ") + jsonObject.getString("error_description"));
        }
    }

    /**
     * https://developer.amazon.com/zh/docs/login-with-amazon/obtain-customer-profile.html#call-profile-endpoint
     *
     * @param authToken token信息
     * @return AuthUser
     */
    @Override
    public AuthUser getUserInfo(AuthToken authToken) {
        String accessToken = authToken.getAccessToken();
        this.checkToken(accessToken);

        HttpHeader httpHeader = new HttpHeader();
        httpHeader.add("Host", "api.amazon.com");
        httpHeader.add("Authorization", "bearer " + accessToken);
        String userInfo = new HttpUtils(config.getHttpConfig()).get(this.source.userInfo(), new HashMap<>(0), httpHeader, false).getBody();

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Read the (duplicated) description text — it names the actual error even though the code is missing due to the bug
2. Verify clientId/clientSecret against the Amazon developer console security profile
3. Ensure redirectUri exactly matches the allowed return URLs of the security profile
4. Exchange the authorization grant promptly; grant_type=authorization_code grants are single-use

Example fix

// before (library code, AuthAmazonRequest.checkResponse)
throw new AuthException(jsonObject.getString("error_description").concat(" ") + jsonObject.getString("error_description"));

// after (fixed upstream)
throw new AuthException(jsonObject.getString("error").concat(" ") + jsonObject.getString("error_description"));

// workaround for callers: match on the description substring, e.g. catch (AuthException e) { if (e.getMessage().contains("invalid_client")) ... }

if (StringUtils.isEmpty(config.getClientSecret())) {
    throw new IllegalStateException("AMAZON clientSecret required");
}
if (!redirectUriRegisteredExactly(config.getRedirectUri())) {
    throw new IllegalStateException("redirect uri must match the LWA security profile exactly");
}

try {
    return amazonRequest.getAccessToken(callback);
} catch (AuthException e) {
    String m = e.getMessage(); // note: description duplicated, code lost (library bug)
    if (m.contains("invalid_client")) refreshCredentialsFromConsole();
    else if (m.contains("invalid_grant")) return redirectToAuthorize(AMAZON);
    throw e;
}

When it happens

Trigger: Any Amazon token or refresh call whose response body includes an error field: invalid_client (bad client id/secret), invalid_grant (bad/expired code or redirect_uri mismatch), invalid_scope, authorization_pending in the LWA device flow.

Common situations: Client secret rotated on the Amazon dev console but not in AuthConfig; auth code replayed (single-use, ~10 min lifetime); redirect URI not matching the one registered in the Login with Amazon security profile.

Related errors

• 5011
• ${errMsg}
• 5008
• ${cause.message}
• ${subMsg}

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/fea40627fbff6639. Report an issue: GitHub.