BerriAI/litellm · error · XAIOAuthError

xAI OAuth discovery returned unexpected endpoint: {url}

Error message

xAI OAuth discovery returned unexpected endpoint: {url}

What it means

XAIOAuthError from endpoint validation: a discovered authorization or token endpoint URL failed the xAI-origin check (wrong scheme/host), so it is refused to prevent the OAuth flow from being pointed at an arbitrary server.

Source

Thrown at litellm/llms/xai/oauth.py:253

            ) from exc
        try:
            data: Final = response.json()
        except ValueError as exc:
            raise XAIOAuthError("xAI OAuth discovery response was not valid JSON") from exc
        authorization_endpoint: Final = data.get("authorization_endpoint")
        token_endpoint: Final = data.get("token_endpoint")
        if not authorization_endpoint or not token_endpoint:
            raise XAIOAuthError("xAI OAuth discovery missing endpoints")
        return {
            "authorization_endpoint": self._validate_xai_endpoint(authorization_endpoint),
            "token_endpoint": self._validate_xai_endpoint(token_endpoint),
        }

    def _validate_xai_endpoint(self, url: str) -> str:
        parsed: Final = urlparse(url)
        host: Final = (parsed.hostname or "").lower()
        if parsed.scheme != "https" or (host != "x.ai" and not host.endswith(".x.ai")):
            raise XAIOAuthError(f"xAI OAuth discovery returned unexpected endpoint: {url}")
        return url

    def _pkce_pair(self) -> tuple[str, str]:
        verifier: Final = base64.urlsafe_b64encode(secrets.token_bytes(32)).rstrip(b"=").decode()
        challenge: Final = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b"=").decode()
        return verifier, challenge

    def _start_callback_server(self, state: str) -> tuple[_CallbackServer, str]:
        last_error: OSError | None = None
        for port in (XAI_OAUTH_REDIRECT_PORT, 0):
            try:
                server = _CallbackServer((XAI_OAUTH_REDIRECT_HOST, port), _CallbackHandler)
                server.expected_state = state
                server.callback_result = None
                actual_port = server.server_address[1]
                redirect_uri = f"http://{XAI_OAUTH_REDIRECT_HOST}:{actual_port}{XAI_OAUTH_REDIRECT_PATH}"
                return server, redirect_uri
            except OSError as exc:

View on GitHub (pinned to 77b7c6c40c)

Solutions

1. Check the unexpected endpoint URL in the error; litellm rejects endpoints that do not match the expected xAI hosts.
2. If xAI changed hosts legitimately, upgrade litellm; otherwise investigate possible DNS/proxy tampering.

When it happens

Trigger: Thrown at litellm/llms/xai/oauth.py:253 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of BerriAI/litellm@77b7c6c40c (2026-08-18). Data as JSON: /api/errors/1feb3166c7379a91. Report an issue: GitHub.