BoundaryML/baml · error

Auth server returned {status}: {body}

Error message

Auth server returned {status}: {body}

What it means

post_form received a non-success HTTP status from the auth server and bails with the status and the raw response body. This is a generic failure of any form POST to the token endpoint (used by device_login and access_token refresh), surfaced before JSON parsing is attempted.

Source

Thrown at baml_language/crates/baml_cli/src/auth.rs:444

}

/// POSTs a form-encoded body and deserializes a successful JSON response.
///
/// Errors:
/// - On network failure, a non-success status (the response body is
///   included in the error), or a body that fails to deserialize as `T`.
fn post_form<T: serde::de::DeserializeOwned>(url: &str, form: &[(&str, &str)]) -> Result<T> {
    let client = http_client();
    let resp = client
        .post(url)
        .header("content-type", "application/x-www-form-urlencoded")
        .body(encode_form(form))
        .send()
        .context("Failed to reach the auth server")?;
    let status = resp.status();
    if !status.is_success() {
        let body = resp.text().unwrap_or_default();
        anyhow::bail!("Auth server returned {status}: {body}");
    }
    resp.json().context("Failed to parse auth server response")
}

fn encode_form(form: &[(&str, &str)]) -> String {
    form.iter()
        .map(|(k, v)| format!("{k}={}", form_urlencode(v)))
        .collect::<Vec<_>>()
        .join("&")
}

/// Percent-encodes a form value.
///
/// RFC 3986 unreserved characters pass through; every other byte is
/// `%XX`-encoded.
fn form_urlencode(s: &str) -> String {
    let mut out = String::with_capacity(s.len());
    for byte in s.bytes() {

View on GitHub (pinned to bd85ce9dee)

Solutions

1. Read the included status/body for the server's specific reason.
2. If the refresh token is invalid/expired, run `baml auth login` again.
3. Check the auth server status / corporate proxy settings.
4. Verify the configured auth endpoint URL.

Example fix

// before: assume 200 always
let tokens: TokenResponse = post_form(...)?;
// after: handle non-2xx explicitly
let resp = client.post(endpoint).form(&form).send()?;
if !resp.status().is_success() {
    eprintln!("auth failed ({}): {}", resp.status(), resp.text()?);
    return Err(anyhow!("re-authenticate with `baml auth login`"));
}

// lightweight reachability probe before auth calls
let ok = std::net::TcpStream::connect(("auth.example.com", 443)).is_ok();

match result {
    Err(e) if e.to_string().contains("Auth server returned") => {
        let status = extract_status(&e);
        if status == 401 || status == 400 {
            // re-authenticate
            baml_cli::auth::login()?;
        } else {
            // 5xx / network: retry with backoff
            retry_with_backoff(op, 3)?;
        }
    }
    r => r?,
}

When it happens

Trigger: POSTing the encoded form (device code grant or refresh token grant) to the token endpoint and receiving status.is_success() == false; the body is read with resp.text().unwrap_or_default().

Common situations: Expired/revoked refresh token on `baml` commands after long absence; auth server outage or 502/503 from a proxy; wrong base URL configured; firewall blocking egress.

Understand the failure class

Background: "API error: {status}" and "HTTP 401/403/404/429/5xx" errors: non-2xx HTTP responses explained — this error's family across 27 libraries.

Related errors

• Timed out after {} minutes waiting for the login to be confi
• Login was denied in the browser.
• the confirmation code expired before it was used; run `baml
• Auth server returned {status}: {value}
• not logged in; run `baml auth login`

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/51d2c7a88c688d11. Report an issue: GitHub.