w7corp/easywechat · error · HttpException

Failed to get authorizer_access_token: %s

Error message

Failed to get authorizer_access_token: %s

What it means

refreshAuthorizerToken() exchanges the stored authorizer_refresh_token for a new authorizer_access_token via cgi-bin/component/api_authorizer_token and throws HttpException with the raw JSON when authorizer_access_token is absent. The refresh token is long-lived but dies when the authorizer cancels the authorization or a re-authorization rotates it, so this error usually means the stored refresh token is no longer current.

Source

Thrown at src/OpenPlatform/Application.php:216

    /**
     * @throws HttpException
     */
    public function refreshAuthorizerToken(string $authorizerAppId, string $authorizerRefreshToken): array
    {
        $response = $this->getClient()->request(
            'POST',
            'cgi-bin/component/api_authorizer_token',
            [
                'json' => [
                    'component_appid' => $this->getAccount()->getAppId(),
                    'authorizer_appid' => $authorizerAppId,
                    'authorizer_refresh_token' => $authorizerRefreshToken,
                ],
            ]
        )->toArray(false);

        if (empty($response['authorizer_access_token'])) {
            throw new HttpException('Failed to get authorizer_access_token: '.json_encode(
                $response,
                JSON_UNESCAPED_UNICODE
            ));
        }

        return $response;
    }

    /**
     * @throws HttpException
     */
    public function createPreAuthorizationCode(): array
    {
        $response = $this->getClient()->request(
            'POST',
            'cgi-bin/component/api_create_preauthcode',
            [
                'json' => [

View on GitHub (pinned to f0cf0a8b83)

Solutions

1. Read the embedded errcode: an invalid refresh token means re-authorization is required — nothing recovers it in place
2. Always persist the latest authorizer_refresh_token returned by every handleAuthorizationCode()/refresh call
3. Trigger the pre-auth flow again to obtain a fresh authorization and replace the stored tokens
4. Keep one storage (DB row per authorizer_appid) as the single source of truth across environments

Example fix

// before: refresh token kept from the very first authorization, never updated
$tokens = $openPlatform->refreshAuthorizerToken($appId, $row->refresh_token);

// after: store whatever the API returns after each refresh
$tokens = $openPlatform->refreshAuthorizerToken($appId, $row->refresh_token);
$row->update(['refresh_token' => $tokens['authorizer_refresh_token']]);

if (blank($row->refresh_token)) {
    throw new \RuntimeException("No authorizer_refresh_token stored for {$appId}; re-authorization required.");
}

try {
    $tokens = $openPlatform->refreshAuthorizerToken($appId, $row->refresh_token);
} catch (\EasyWeChat\Kernel\Exceptions\HttpException $e) {
    // treat as revoked authorization: flag the row, notify ops, start the re-auth flow
    $row->update(['status' => 'reauth_required']);
    report($e);
}

When it happens

Trigger: The authorizer removed the third-party app or reset authorization in the MP console; an older refresh token is stored after a newer re-authorization overwrote it; a truncated or wrong token was passed; component credentials invalid so the whole call is rejected.

Common situations: Re-auth flows that fail to persist the newly returned authorizer_refresh_token; long-lived DB rows going stale after the authorizer re-authorized from another environment sharing the appid; partial writes losing the token column.

Related errors

• Failed to get authorization_info: %s
• getPhoneNumber error: %s
• No component_verify_ticket found.
• Failed to get component_access_token: %s
• Failed to get auth_corp_info: %s

AI-assisted analysis of w7corp/easywechat@f0cf0a8b83 (2026-08-21). Data as JSON: /api/errors/01719c8a58734431. Report an issue: GitHub.