What causes "${error}; ${response_metadata.messages}" in justauth/JustAuth?

Read the leading token of the message: Slack error codes are enumerated at api.slack.com/methods — 'invalid_auth' means bad token, 'invalid_client_secret'/'bad_verification_code' mean code exchange config mismatch.

justauth/JustAuth · error · AuthException

${error}; ${response_metadata.messages}

Error message

${error}; ${response_metadata.messages}

What it means

AuthSlackRequest.checkResponse inspects the Slack Web API envelope: every Slack response carries an `ok` boolean. When ok is false, JustAuth throws AuthException whose message is the `error` field (Slack machine-readable error code such as 'invalid_auth', 'not_authed') plus any human-readable hints from response_metadata.messages joined with commas. Note this exception has no error code — only a message.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthSlackRequest.java:106

        return AuthResponse.builder().code(status.getCode()).msg(status.getMsg()).build();
    }

    /**
     * 检查响应内容是否正确
     *
     * @param object 请求响应内容
     */
    private void checkResponse(JSONObject object) {
        if (!object.getBooleanValue("ok")) {
            String errorMsg = object.getString("error");
            if (object.containsKey("response_metadata")) {
                JSONArray array = object.getJSONObject("response_metadata").getJSONArray("messages");
                if (null != array && array.size() > 0) {
                    errorMsg += "; " + String.join(",", array.toArray(new String[0]));
                }
            }

            throw new AuthException(errorMsg);
        }
    }

    @Override
    public String userInfoUrl(AuthToken authToken) {
        return UrlBuilder.fromBaseUrl(source.userInfo())
            .queryParam("user", authToken.getUid())
            .build();
    }

    /**
     * 返回带{@code state}参数的授权url，授权回调时会带上这个{@code state}
     *
     * @param state state 验证授权流程的参数，可以防止csrf
     * @return 返回授权地址
     */
    @Override
    public String authorize(String state) {

View on GitHub (pinned to 694bbf1b01)

Solutions

Read the leading token of the message: Slack error codes are enumerated at api.slack.com/methods — 'invalid_auth' means bad token, 'invalid_client_secret'/'bad_verification_code' mean code exchange config mismatch.
Verify clientId/clientSecret in AuthConfig match the current Slack app (Basic Information > App Credentials).
Confirm the user scope includes identity.basic (Slack Sign-In requires user tokens, not bot tokens).
If the app was reinstalled, have the user re-authorize via authorize(state) to mint fresh tokens.

Example fix

// before: config with stale secret
new AuthSlackRequest(AuthConfig.builder().clientIdId? ...);

// after: align credentials + user scope
AuthConfig cfg = AuthConfig.builder()
    .clientId("current-client-id")
    .clientSecret("current-client-secret")
    .redirectUri("https://app.example.com/oauth/slack/callback")
    .scopes(AuthSlackScope.IDENTITY_BASIC_USER)
    .build();

Defensive patterns

Strategy: try-catch

Validate before calling

// pre-flight: cheap API call to confirm creds before full flow
// (Slack auth.test with the bot token) — verify clientId/clientSecret non-empty
if (StringUtils.isAnyEmpty(config.getClientId(), config.getClientSecret())) {
    throw new IllegalArgumentException("Slack clientId/clientSecret required");
}

Try / catch

try {
    AuthUser user = request.login(callback);
} catch (AuthException e) {
    String msg = String.valueOf(e.getMessage());
    if (msg.startsWith("invalid_auth") || msg.startsWith("not_authed")) {
        // token revoked/rotated: force re-consent
        redirect(request.authorize(freshState()));
    } else throw e;
}

Prevention

Store Slack app credentials in a config service and rotate them atomically with deploys.
Subscribe to Slack 'app_uninstalled' / 'tokens_revoked' events to drop stored tokens immediately.
Request the identity.basic user scope explicitly in AuthConfig.

When it happens

Trigger: Any Slack API call made by AuthSlackRequest (getAccessToken via oauth.access, getUserInfo via users.identity) after the user installation is broken: invalid/revoked bot token, wrong client_id/client_secret on code exchange, missing identity scope, or redirect_uri mismatch.

Common situations: Rotating Slack app credentials without updating AuthConfig; the Slack app was reinstalled and the old token was invalidated; requesting 'identity.basic' but the app only has 'identity:basic' style scope naming issues; workspace admin uninstalled the app.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/1ca88b207fe8ca58. Report an issue: GitHub.