部署Flask版LINE回声Bot后遭遇API授权错误（403）求助

问题概述 #

基于Python Flask版回声机器人示例部署到Heroku平台，Procfile配置为web: gunicorn app:app，已填写Channel Secret和Channel Access Token，但发送消息后机器人无响应，Heroku日志返回以下错误：

2023-01-16T14:30:52.927195+00:00 heroku[router]: at=info method=POST path="/callback" host=maid-chan.herokuapp.com request_id=502e05cb-10d1-46b5-b451-fd42984520d5 fwd="147.92.149.165" dyno=web.1 connect=0ms service=1068ms status=500 bytes=438 protocol=https
2023-01-16T14:30:52.924657+00:00 app[web.1]: [2023-01-16 14:30:52,922] ERROR in app: Exception on /callback [POST]
2023-01-16T14:30:52.924683+00:00 app[web.1]: Traceback (most recent call last):
2023-01-16T14:30:52.924683+00:00 app[web.1]:   File "/app/.heroku/python/lib/python3.10/site-packages/flask/app.py", line 2525, in wsgi_app
2023-01-16T14:30:52.924683+00:00 app[web.1]:     response = self.full_dispatch_request()
2023-01-16T14:30:52.924684+00:00 app[web.1]:   File "/app/.heroku/python/lib/python3.10/site-packages/flask/app.py", line 1822, in full_dispatch_request
2023-01-16T14:30:52.924684+00:00 app[web.1]:     rv = self.handle_user_exception(e)
2023-01-16T14:30:52.924684+00:00 app[web.1]:   File "/app/.heroku/python/lib/python3.10/site-packages/flask/app.py", line 1820, in full_dispatch_request
2023-01-16T14:30:52.924684+00:00 app[web.1]:     rv = self.dispatch_request()
2023-01-16T14:30:52.924684+00:00 app[web.1]:   File "/app/.heroku/python/lib/python3.10/site-packages/flask/app.py", line 1796, in dispatch_request
2023-01-16T14:30:52.924685+00:00 app[web.1]:     return self.ensure_sync(self.view_functions[rule.endpoint])(**view_args)
2023-01-16T14:30:52.924685+00:00 app[web.1]:   File "/app/app.py", line 57, in callback
2023-01-16T14:30:52.924685+00:00 app[web.1]:     handler.handle(body, signature)
2023-01-16T14:30:52.924685+00:00 app[web.1]:   File "/app/.heroku/python/lib/python3.10/site-packages/linebot/webhook.py", line 259, in handle
2023-01-16T14:30:52.924685+00:00 app[web.1]:     self.__invoke_func(func, event, payload)
2023-01-16T14:30:52.924686+00:00 app[web.1]:   File "/app/.heroku/python/lib/python3.10/site-packages/linebot/webhook.py", line 271, in __invoke_func
2023-01-16T14:30:52.924686+00:00 app[web.1]:     func(event)
2023-01-16T14:30:52.924686+00:00 app[web.1]:   File "/app/app.py", line 66, in message_text
2023-01-16T14:30:52.924687+00:00 app[web.1]:     line_bot_api.reply_message(
2023-01-16T14:30:52.924687+00:00 app[web.1]:   File "/app/.heroku/python/lib/python3.10/site-packages/linebot/api.py", line 113, in reply_message
2023-01-16T14:30:52.924687+00:00 app[web.1]:     self._post(
2023-01-16T14:30:52.924687+00:00 app[web.1]:   File "/app/.heroku/python/lib/python3.10/site-packages/linebot/api.py", line 1860, in _post
2023-01-16T14:30:52.924687+00:00 app[web.1]:     self.__check_error(response)
2023-01-16T14:30:52.924687+00:00 app[web.1]:   File "/app/.heroku/python/lib/python3.10/site-packages/linebot/api.py", line 1896, in __check_error
2023-01-16T14:30:52.924688+00:00 app[web.1]:     raise LineBotApiError(
2023-01-16T14:30:52.924688+00:00 app[web.1]: linebot.exceptions.LineBotApiError: LineBotApiError: status_code=403, request_id=bd667144-c714-4ef7-a298-b58aca43ee9b, error_response={"details": [], "message": "Access to this API denied due to authorization error"}, headers={'Content-Type': 'application/json', 'Server': 'envoy', 'x-content-type-options': 'nosniff', 'x-frame-options': 'DENY', 'x-line-request-id': 'bd667144-c714-4ef7-a298-b58aca43ee9b', 'x-xss-protection': '1; mode=block', 'Content-Length': '66', 'Expires': 'Mon, 16 Jan 2023 14:30:52 GMT', 'Cache-Control': 'max-age=0, no-cache, no-store', 'Pragma': 'no-cache', 'Date': 'Mon, 16 Jan 2023 14:30:52 GMT', 'Connection': 'close'}
2023-01-16T14:30:52.929820+00:00 app[web.1]: 10.1.54.190 - - [16/Jan/2023:14:30:52 +0000] "POST /callback HTTP/1.1" 500 265 "-" "LineBotWebhook/2.0"

排查与解决步骤 #

• 验证Channel Access Token有效性
  1. 登录LINE开发者控制台，进入对应频道的「Messaging API」页面
  2. 确认使用的是长效Channel Access Token，短期Token会自动过期
  3. 检查Token是否完整复制，无多余空格、换行或拼写错误
• 检查API权限配置
  在Messaging API页面，确认「使用权限」中已启用「回复消息」「接收消息」等必要权限
• 确认Heroku环境变量配置
  1. 避免在代码中硬编码敏感信息，改用Heroku环境变量注入
  2. 在Heroku控制台的应用「设置」-「Config Vars」中添加CHANNEL_SECRET和CHANNEL_ACCESS_TOKEN，值与LINE控制台完全一致
• 验证机器人发布状态
  在Messaging API页面，确认已点击「发布」按钮，将机器人正式上线到对应频道
• 检查Webhook验证状态
  确认Webhook URL已通过LINE服务器的验证，确保Heroku应用的回调地址可正常访问

内容的提问来源于stack exchange，提问作者Andrew