justauth/JustAuth · error · AuthException

response.getErrorMsg()

Error message

response.getErrorMsg()

What it means

AuthQQMiniProgramRequest.checkResponse throws AuthException carrying the WeChat QQ Mini Program JSCode2SessionResponse errorCode and errorMsg when errorCode != 0. This wraps WeChat's code-to-session endpoint (jscode2session) used for mini-program login.

Source

Thrown at src/main/java/me/zhyd/oauth/request/AuthQQMiniProgramRequest.java:70

        // 如果需要用户信息，需要在小程序调用函数后传给后端
        return AuthUser.builder()
            .username("")
            .nickname("")
            .avatar("")
            .uuid(authToken.getOpenId())
            .token(authToken)
            .source(source.toString())
            .build();
    }

    /**
     * 检查响应内容是否正确
     *
     * @param response 请求响应内容
     */
    private void checkResponse(JSCode2SessionResponse response) {
        if (response.getErrorCode() != 0) {
            throw new AuthException(response.getErrorCode(), response.getErrorMsg());
        }
    }

    @Override
    protected String accessTokenUrl(String code) {
        return UrlBuilder.fromBaseUrl(source.accessToken())
            .queryParam("appid", config.getClientId())
            .queryParam("secret", config.getClientSecret())
            .queryParam("js_code", code)
            .queryParam("grant_type", "authorization_code")
            .build();
    }

    @Data
    @SuppressWarnings("SpellCheckingInspection")
    private static class JSCode2SessionResponse {

        @JSONField(name = "errcode")

View on GitHub (pinned to 694bbf1b01)

Solutions

1. Map errorCode via WeChat docs: 40029 invalid code, 40126 code already used, 45011 rate-limited, -1 system busy then retry
2. Ensure clientId/clientSecret are the mini program's AppID/AppSecret and the js_code came from wx.login() in THAT mini program
3. Exchange the code immediately server-side; never cache and replay js_code
4. Handle 45011 with a retry-after backoff

Example fix

null

// client side: only exchange codes from wx.login() issued < 5 minutes ago
// server side: dedupe js_code before exchange
if (seenCodes.contains(jsCode)) { throw new IllegalStateException("code already exchanged"); }
seenCodes.add(jsCode);

null

try {
    AuthToken t = qqMiniRequest.getAccessToken(callback);
} catch (AuthException e) {
    int code = e.getCode();
    if (code == 40029 || code == 40126) { /* bad/used js_code → client must call wx.login() again */ }
    else if (code == 45011) { /* rate limited → backoff */ }
    else if (code == -1) { /* WeChat busy → single retry */ }
}

When it happens

Trigger: Calling getAccessToken with a js_code that WeChat rejects: invalid code (already used or >5 min old), invalid appid/secret pair, or appid not matching the mini program that issued the code.

Common situations: Using the secret from a different mini program, code replayed after a retry, or the js_code expiring (5-minute validity) before the backend exchange.

Related errors

• 不支持获取授权 url，请使用小程序内置函数 wx.login() 登录获取 code
• 不支持获取用户信息 url，请使用小程序内置函数 wx.getUserProfile() 获取用户信息
• 不支持获取授权 url，请使用小程序内置函数 qq.login() 登录获取 code
• 不支持获取用户信息 url，请使用小程序内置函数 qq.getUserInfo() 获取用户信息
• object.getString("error_description") / object.getString("er

AI-assisted analysis of justauth/JustAuth@694bbf1b01 (2026-08-14). Data as JSON: /api/errors/f31e1d7c1f498f0e. Report an issue: GitHub.