What causes "Failed to get access_token: %s" in w7corp/easywechat?

Read the embedded errcode/errmsg to distinguish invalid permanent code from invalid suite credential

w7corp/easywechat · error · HttpException

Failed to get access_token: %s

Error message

Failed to get access_token: %s

What it means

OpenWork\AuthorizerAccessToken fetches an authorizer corp access_token via cgi-bin/service/get_corp_token (auth_corpid plus permanent_code, authorized by the suite token) and throws HttpException with the embedded JSON when access_token is absent. Every API call made on behalf of the authorizer corp funnels through this, so the exception marks the whole authorizer credential layer as broken.

Source

Thrown at src/OpenWork/AuthorizerAccessToken.php:99

     */
    public function refresh(): string
    {
        if (! isset($this->suiteAccessToken)) {
            return '';
        }

        $response = $this->httpClient->request('POST', 'cgi-bin/service/get_corp_token', [
            'query' => [
                'suite_access_token' => $this->suiteAccessToken->getToken(),
            ],
            'json' => [
                'auth_corpid' => $this->corpId,
                'permanent_code' => $this->permanentCodeOrAccessToken,
            ],
        ])->toArray(false);

        if (empty($response['access_token'])) {
            throw new HttpException('Failed to get access_token: '.json_encode($response, JSON_UNESCAPED_UNICODE));
        }

        $this->cache->set($this->getKey(), $response['access_token'], intval($response['expires_in']));

        return $response['access_token'];
    }
}

View on GitHub (pinned to f0cf0a8b83)

Solutions

Read the embedded errcode/errmsg to distinguish invalid permanent code from invalid suite credential
If the authorization was revoked, flag the authorizer record and require reinstall through the suite flow
Refresh the suite access token, then retry the corp-token fetch once
Keep permanent codes stored per corp and update them on every re-authorization

Defensive patterns

Strategy: try-catch

Validate before calling

if (blank($corpId) || blank($permanentCode)) {
    throw new \RuntimeException('corpId and permanent_code are required to fetch an authorizer token.');
}

Try / catch

try {
    $token = $authorizerAccessToken->getToken();
} catch (\EasyWeChat\Kernel\Exceptions\HttpException $e) {
    $payload = json_decode(strstr($e->getMessage(), '{') ?: '[]', true) ?: [];
    if (str_contains((string) ($payload['errmsg'] ?? ''), 'invalid permanent')) {
        $corpRow->update(['status' => 'reauth_required']);
    }
    report($e);
}

Prevention

Cache authorizer access tokens and refresh only on expiry, not per call
Store permanent codes per corp and update them on re-authorization
Distinguish 'revoked authorization' from 'transient credential failure' in error handling

When it happens

Trigger: The authorizer corp removed the suite app so permanent_code is invalid; a wrong or mismatched corp id / permanent code pair was persisted; the suite_access_token carried in the query string expired or was rejected.

Common situations: Long-lived installations where the authorizer later uninstalled the app; per-corp rows missing after migration; suite token caches wiped across all nodes at once, making every corp call fail together.

Related errors

AI-assisted analysis of w7corp/easywechat@f0cf0a8b83 (2026-08-21). Data as JSON: /api/errors/079c34bb48e6d30d. Report an issue: GitHub.