justauth/JustAuth · error · AuthException

jsonObject.getString("message")

Error message

jsonObject.getString("message")

What it means

AuthFeishuRequest.checkResponse() treats any response whose top-level 'code' is not 0 as a failure and throws AuthException with the 'message' field - Feishu/Lark's standard envelope is {code, msg/message}. It runs after token, refresh, and user-info calls.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthFeishuRequest.java:145

    @Override
    public String authorize(String state) {
        return UrlBuilder.fromBaseUrl(source.authorize())
            .queryParam("app_id", config.getClientId())
            .queryParam("redirect_uri", GlobalAuthUtils.urlEncode(config.getRedirectUri()))
            .queryParam("state", getRealState(state))
            .build();
    }


    /**
     * 校验响应内容是否正确
     *
     * @param jsonObject 响应内容
     */
    private void checkResponse(JSONObject jsonObject) {
        if (jsonObject.getIntValue("code") != 0) {
            throw new AuthException(jsonObject.getString("message"));
        }
    }

}

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Add the exact redirect URI domain to the Feishu app's 'Security Settings > Redirect URLs' list.
2. Verify app_id/app_secret belong to the same Feishu app and it is enabled for web login.
3. Apply for and approve the user-info scope in the app's permission settings, then re-authorize so the new scope is granted.
4. Catch AuthException and log the 'message' text - Feishu messages (e.g. 'app secret is invalid') state the cause directly.

try {
    return feishuRequest.getAccessToken(callback);
} catch (AuthException e) {
    log.warn("Feishu error: {}", e.getErrorMsg());
    if (String.valueOf(e.getErrorMsg()).contains("redirect")) {
        throw new ConfigurationException("Feishu redirect URL not registered in app security settings", e);
    }
    throw e;
}

When it happens

Trigger: Token exchange or getUserInfo() when Feishu returns non-zero code: invalid app_id/app_secret, an unregistered redirect URI, an expired one-time code, or the app missing the required scopes (e.g. 'contact:user.base:readonly' for user info).

Common situations: Redirect URL domain not added to Feishu's web app security settings; credentials from a different Feishu app (custom app vs store app); or calling user info without applying for the corresponding API permission/scope.

Related errors

• object.getString("error_description") / object.getString("er
• object.getString("msg")
• object.getString("error")
• JSONObject.toJSONString(response)
• data.getString("description")

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/4e3dae174df3465f. Report an issue: GitHub.