What causes "object.getString("error_description")" in justauth/JustAuth?

Compare AuthConfig.redirectUri with the console-registered callback character by character (scheme, host, path, trailing slash).

justauth/JustAuth · error · AuthException

object.getString("error_description")

Error message

object.getString("error_description")

What it means

AuthElemeRequest.checkResponse() runs on token-endpoint responses: any 'error' key in the JSON causes AuthException with the 'error_description' text (standard OAuth2 error envelope). This fires while exchanging the authorization code or refreshing the token.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthElemeRequest.java:174

        HttpHeader httpHeader = new HttpHeader();
        httpHeader.add("Accept", "text/xml,text/javascript,text/html");
        httpHeader.add(Constants.CONTENT_TYPE, contentType);
        httpHeader.add("Accept-Encoding", "gzip");
        httpHeader.add("User-Agent", "eleme-openapi-java-sdk");
        httpHeader.add("x-eleme-requestid", requestId);
        if (auth) {
            httpHeader.add("Authorization", this.getBasic(config.getClientId(), config.getClientSecret()));
        }
        return httpHeader;
    }

    private String getRequestId() {
        return (UuidUtils.getUUID() + "|" + System.currentTimeMillis()).toUpperCase();
    }

    private void checkResponse(JSONObject object) {
        if (object.containsKey("error")) {
            throw new AuthException(object.getString("error_description"));
        }
    }

}

View on GitHub (pinned to 694bbf1b01)

Solutions

Compare AuthConfig.redirectUri with the console-registered callback character by character (scheme, host, path, trailing slash).
Confirm client_id/client_secret are current for the Eleme app.
Consume each authorization code once - persist the state parameter and reject duplicate callbacks.
Inspect error_description in the AuthException: OAuth2 wording like 'invalid_grant' or 'invalid_client' maps directly to secret vs code problems.

Defensive patterns

Strategy: try-catch

Validate before calling

// Compare redirect URIs before starting the flow
public void verifyElemeRedirect(String configured, String registered) {
    if (!Objects.equals(normalize(configured), normalize(registered))) {
        throw new IllegalStateException("Eleme redirect_uri mismatch: " + configured + " vs " + registered);
    }
}
private String normalize(String u) { return u == null ? null : u.replaceAll("/$", ""); }

Try / catch

try {
    return elemeRequest.getAccessToken(callback);
} catch (AuthException e) {
    log.warn("Eleme token error: {}", e.getErrorMsg()); // OAuth2 error_description text
    if (e.getErrorMsg() != null && e.getErrorMsg().contains("client")) {
        throw new ConfigurationException("Eleme client credentials rejected", e);
    }
    throw e;
}

Prevention

Register the exact redirect URI (scheme, host, path, trailing slash) in the Eleme console and reuse it verbatim in AuthConfig.
Treat 'invalid_client' as a config incident: alert and stop retrying until secrets are fixed.
Deduplicate callback processing by state so a code is never exchanged twice.

When it happens

Trigger: getAccessToken()/refresh() when Eleme rejects the OAuth2 request: wrong client_id/client_secret, mismatched redirect_uri, or an already-consumed authorization code - Eleme answers {"error":"...","error_description":"..."}.

Common situations: Redirect URI registered in the Eleme console differs (trailing slash, http vs https) from AuthConfig.redirectUri; credentials rotated in the console; double exchange of the code after a callback retry.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/fd51da8d522b2b82. Report an issue: GitHub.