justauth/JustAuth · error · AuthException

object.getString("sub_error") + ":" + object.getString("erro

Error message

object.getString("sub_error") + ":" + object.getString("error_description")

What it means

Second branch of AuthHuaweiV3Request.checkResponse: when the response JSON contains an 'error' key, JustAuth throws AuthException with 'sub_error:error_description' concatenated. This is the standard OAuth2 error shape Huawei returns for grant failures (bad code, invalid client, missing scope).

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthHuaweiV3Request.java:191

            builder.queryParam("code_challenge", codeChallenge)
                .queryParam("code_challenge_method", codeChallengeMethod);
            // 缓存 codeVerifier 十分钟
            this.authStateCache.cache(cacheKey, codeVerifier, TimeUnit.MINUTES.toMillis(10));
        }
        return builder.build();
    }

    /**
     * 校验响应结果
     *
     * @param object 接口返回的结果
     */
    private void checkResponse(JSONObject object) {
        if (object.containsKey("NSP_STATUS")) {
            throw new AuthException(object.getString("error"));
        }
        if (object.containsKey("error")) {
            throw new AuthException(object.getString("sub_error") + ":" + object.getString("error_description"));
        }
    }


}

View on GitHub (pinned to 694bbf1b01)

Solutions

Read the sub_error/error_description pair in the exception message: invalid_grant means get a new code; invalid_client means fix credentials
Ensure the authorization URL was built from the same clientId used in the token exchange
Check that requested scopes are approved for the app in AppGallery Connect
Catch AuthException at the login endpoint and redirect the user to re-authorize

Example fix

null

Defensive patterns

Strategy: try-catch

Validate before calling

null

Type guard

null

Try / catch

try {
    huaweiRequest.getAuthResponse(callback);
} catch (AuthException e) {
    // message pattern: sub_error:error_description
    String[] parts = String.valueOf(e.getMessage()).split(":", 2);
    if (parts[0].contains("invalid_grant")) { /* restart OAuth flow */ }
}

Prevention

Exchange the authorization code immediately (Huawei codes expire in minutes)
Only request scopes enabled for the app in AppGallery Connect
Differentiate invalid_client (fix secret) from invalid_grant (new code) before retrying

When it happens

Trigger: Any Huawei V3 token or refresh call whose response body includes an 'error' object/field, e.g. invalid_grant on code replay, invalid_client on secret mismatch, or missing open scope permissions.

Common situations: Expired or reused authorization code, wrong client secret, requesting scopes (e.g. getAvatar) not enabled for the app, or clock skew causing the code to appear expired.

Related errors

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/d326a8b65a5b6067. Report an issue: GitHub.