w7corp/easywechat · error · HttpException

Failed to get authorization_info: %s

Error message

Failed to get authorization_info: %s

What it means

OpenPlatform\Application::handleAuthorizationCode() POSTs the one-time authorization_code to cgi-bin/component/api_query_auth and throws HttpException (raw JSON embedded) when authorization_info is missing. The authorization_code is issued once in the auth-callback URL, is single-use, and expires within minutes, so a failed exchange usually means the code was bad, reused, or the component credentials were stale.

Source

Thrown at src/OpenPlatform/Application.php:189

    /**
     * @throws HttpException
     */
    public function getAuthorization(string $authorizationCode): Authorization
    {
        $response = $this->getClient()->request(
            'POST',
            'cgi-bin/component/api_query_auth',
            [
                'json' => [
                    'component_appid' => $this->getAccount()->getAppId(),
                    'authorization_code' => $authorizationCode,
                ],
            ]
        )->toArray(false);

        if (empty($response['authorization_info'])) {
            throw new HttpException('Failed to get authorization_info: '.json_encode(
                $response,
                JSON_UNESCAPED_UNICODE
            ));
        }

        return new Authorization($response);
    }

    /**
     * @throws HttpException
     */
    public function refreshAuthorizerToken(string $authorizerAppId, string $authorizerRefreshToken): array
    {
        $response = $this->getClient()->request(
            'POST',
            'cgi-bin/component/api_authorizer_token',
            [
                'json' => [

View on GitHub (pinned to f0cf0a8b83)

Solutions

  1. Decode the embedded errcode/errmsg — invalid/expired code errors mean the authorizer must click through the auth page again
  2. Exchange the code exactly once, immediately inside the callback handler, and persist the returned authorizer tokens
  3. If it was already consumed, restart the flow: createPreAuthorizationCode() and send the authorizer a new pre-authorization URL
  4. For systemic errcodes, fix the component ticket/token layer (see VerifyTicket) before retrying

Example fix

// before: retrying or refreshing the callback reuses a consumed code
$auth = $openPlatform->handleAuthorizationCode($authorizationCode);

// after: exchange once and idempotently re-initiate on failure
if (! $cache->has("authcode:{$authorizationCode}")) {
    $cache->set("authcode:{$authorizationCode}", 1, 600);
    $auth = $openPlatform->handleAuthorizationCode($authorizationCode);
} else {
    return redirect($openPlatform->createPreAuthorizationUrl($callbackUrl));
}
Defensive patterns

Strategy: try-catch

Validate before calling

if ($cache->has("authcode:{$authorizationCode}")) {
    // already consumed once: skip straight to issuing a new pre-auth URL
    return redirect($openPlatform->createPreAuthorizationUrl($callbackUrl));
}

Try / catch

try {
    $auth = $openPlatform->handleAuthorizationCode($authorizationCode);
} catch (\EasyWeChat\Kernel\Exceptions\HttpException $e) {
    $payload = json_decode(strstr($e->getMessage(), '{') ?: '[]', true) ?: [];
    // invalid/expired-code errcodes → send the authorizer a fresh pre-auth URL instead of retrying
    report($e);
}

Prevention

When it happens

Trigger: Replaying the authorization callback URL (refresh, double-submit, retry job) after the code was consumed; processing the callback later than the code's TTL; stale component_verify_ticket/component_access_token; wrong component appid in the request.

Common situations: An admin refreshes the callback page after completing authorization; queue workers process the same callback event twice; dev and prod both consume a code meant for one environment; long delay between WeChat's redirect and the server-side exchange.

Related errors

AI-assisted analysis of w7corp/easywechat@f0cf0a8b83 (2026-08-21). Data as JSON: /api/errors/6320ae9f7575161f. Report an issue: GitHub.