What causes "object.getString("error") + ":" + object.getString("message")" in justauth/JustAuth?

Split the thrown message on ':' - the left part is the OAuth2 error code, the right part the human text.

justauth/JustAuth · error · AuthException

object.getString("error") + ":" + object.getString("message"

Error message

object.getString("error") + ":" + object.getString("message")

What it means

AuthFigmaRequest.checkResponse() throws when the Figma OAuth response contains an 'error' key; the message concatenates error + ':' + message (e.g. 'invalid_grant:Code already redeemed'). It guards both the token endpoint and the user endpoint.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthFigmaRequest.java:115

            .rawUserInfo(dataObj)
            .uuid(dataObj.getString("id"))
            .username(dataObj.getString("handle"))
            .avatar(dataObj.getString("img_url"))
            .email(dataObj.getString("email"))
            .token(authToken)
            .source(source.toString())
            .build();
    }


    /**
     * 校验响应结果
     *
     * @param object 接口返回的结果
     */
    private void checkResponse(JSONObject object) {
        if (object.containsKey("error")) {
            throw new AuthException(object.getString("error") + ":" + object.getString("message"));
        }
    }
}

View on GitHub (pinned to 694bbf1b01)

Solutions

Split the thrown message on ':' - the left part is the OAuth2 error code, the right part the human text.
Exchange the code exactly once per callback; use the state parameter or a nonce to detect replays.
Re-copy client_id/client_secret/redirect_uri from the Figma app settings page after any credential change.
Handle 'invalid_grant' by discarding stored tokens and redirecting the user to re-authorize.

Defensive patterns

Strategy: try-catch

Try / catch

try {
    return figmaRequest.getAccessToken(callback);
} catch (AuthException e) {
    String m = String.valueOf(e.getErrorMsg());
    if (m.startsWith("invalid_grant")) {
        return redirectToReauthorize(); // code already redeemed or expired
    }
    throw e;
}

Prevention

Make callback handlers idempotent on the state parameter so a code is never redeemed twice.
Re-sync client_id/secret/redirect_uri from the Figma app page after any settings change.
Map OAuth2 error codes (invalid_grant, invalid_client, redirect_uri_mismatch) to distinct handling paths.

When it happens

Trigger: Exchanging the authorization code or fetching the Figma user with a wrong client_secret, an already-used code, or a redirect_uri mismatch - Figma returns the standard OAuth2 {error, error_description/message} envelope.

Common situations: Redeeming the code twice after the callback page is reloaded; the OAuth client secret was regenerated in Figma's account settings; the redirect URI in AuthConfig differs from the one on the Figma app page.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/fcb2d8158c6d9691. Report an issue: GitHub.