justauth/JustAuth · error · AuthException

object.containsKey("error") + ":" + object.getString("error_

Error message

object.containsKey("error") + ":" + object.getString("error_description")

What it means

AuthGoogleRequest.checkResponse() throws when a Google response carries 'error' or 'error_description'. Note a formatting quirk in the message: it concatenates the boolean containsKey("error") with the description, so typical output is 'true:...' (or 'false:<description>' when only error_description is present) - the useful text is whatever follows the colon.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthGoogleRequest.java:104

    /**
     * 返回获取userInfo的url
     *
     * @param authToken 用户授权后的token
     * @return 返回获取userInfo的url
     */
    @Override
    protected String userInfoUrl(AuthToken authToken) {
        return UrlBuilder.fromBaseUrl(source.userInfo()).queryParam("access_token", authToken.getAccessToken()).build();
    }

    /**
     * 检查响应内容是否正确
     *
     * @param object 请求响应内容
     */
    private void checkResponse(JSONObject object) {
        if (object.containsKey("error") || object.containsKey("error_description")) {
            throw new AuthException(object.containsKey("error") + ":" + object.getString("error_description"));
        }
    }
}

View on GitHub (pinned to 694bbf1b01)

Solutions

Verify the client_id/client_secret pair and that AuthConfig.redirectUri appears verbatim in Google Cloud Console > Credentials > Authorized redirect URIs.
Sync server time (NTP) - Google rejects token requests with significant clock drift.
Parse the text after ':' in the exception message for the actual Google error string ('invalid_grant', 'redirect_uri_mismatch', etc.).
Re-authorize the user when the error is revoked/invalid token; refreshing will not help for revoked grants.

Example fix

// before - boolean leaks into the message
if (object.containsKey("error") || object.containsKey("error_description")) {
    throw new AuthException(object.containsKey("error") + ":" + object.getString("error_description"));
}

// after - emit the real error text
if (object.containsKey("error") || object.containsKey("error_description")) {
    String err = object.getString("error");
    String desc = object.getString("error_description");
    throw new AuthException(err != null ? err + ":" + desc : desc);
}

Defensive patterns

Strategy: try-catch

Try / catch

try {
    return googleRequest.getAccessToken(callback);
} catch (AuthException e) {
    // message looks like 'true:<google description>' - use the part after the colon
    String desc = String.valueOf(e.getErrorMsg()).replaceFirst("^(true|false):", "");
    if (desc.contains("invalid_client")) {
        throw new ConfigurationException("Google client credentials rejected", e);
    }
    if (desc.contains("redirect_uri_mismatch")) {
        throw new ConfigurationException("Add the exact redirectUri in Google Cloud Console", e);
    }
    throw e;
}

Prevention

Add the exact redirect URI (no trailing slash) to Google Cloud Console > Credentials before first login test.
Run NTP on servers - clock drift causes Google 'invalid_grant' during code exchange.
Do not trust the raw exception message format for Google - parse after the leading boolean prefix.

When it happens

Trigger: Token exchange with a mismatched client_secret or redirect_uri (Google returns error='invalid_grant'/'invalid_client'), a code exchanged twice, or userinfo called with a revoked/expired Google token.

Common situations: Google Cloud OAuth client secret rotated; redirect URI not added to the Google Cloud Console authorized redirect URIs (exact match required, no trailing slash); clock skew on the server causing 'invalid_grant' on code exchange; user revoked third-party access in their Google account.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/57981c040867d372. Report an issue: GitHub.