BoundaryML/baml · error

Auth server returned {status}: {value}

Error message

Auth server returned {status}: {value}

What it means

Catch-all branch of poll_token_endpoint: the token endpoint returned an unrecognized `error` value (anything besides authorization_pending, slow_down, access_denied, expired_token), so the CLI bails echoing the HTTP status and raw error payload. It signals an unexpected condition from the auth server.

Source

Thrown at baml_language/crates/baml_cli/src/auth.rs:403

            .json()
            .context("Failed to parse token endpoint response")?;

        if status.is_success() {
            return serde_json::from_value(value).context("Failed to parse token response");
        }

        let error = value.get("error").and_then(|e| e.as_str()).unwrap_or("");
        match error {
            "authorization_pending" => std::thread::sleep(interval),
            "slow_down" => {
                interval += Duration::from_secs(5);
                std::thread::sleep(interval);
            }
            "access_denied" => anyhow::bail!("Login was denied in the browser."),
            "expired_token" => anyhow::bail!(
                "the confirmation code expired before it was used; run `baml auth login` again"
            ),
            _ => anyhow::bail!("Auth server returned {status}: {value}"),
        }
    }
}

// ---------------------------------------------------------------------------
// Request plumbing
// ---------------------------------------------------------------------------

/// WorkOS authenticate response. Field presence varies by grant, so
/// everything but `access_token` is optional.
#[derive(Debug, Deserialize)]
struct TokenResponse {
    access_token: String,
    refresh_token: Option<String>,
    expires_in: Option<u64>,
    user: Option<TokenUser>,
}

View on GitHub (pinned to bd85ce9dee)

Solutions

1. Read the echoed status and value to identify the server-side error.
2. Verify the auth endpoint/region configuration is correct and up to date.
3. Update the BAML CLI to a version that knows the new error code.
4. Retry later if the auth server is degraded (5xx status).

match baml_cli::auth::device_login(...) {
    Err(e) if e.to_string().contains("Auth server returned") => {
        // log full context; retry with backoff or report to server operator
        eprintln!("{e:#}");
        retry_with_backoff(|| baml_cli::auth::device_login(...), 3)?;
    }
    r => r?,
}

When it happens

Trigger: device_login -> poll_token_endpoint receiving a token response whose `error` field matches none of the known device-flow error codes.

Common situations: Auth server version drift introducing new error codes (e.g. invalid_client, invalid_scope, server errors surfaced as the error field); proxy/gateway injecting error pages; pointing the CLI at a custom/wrong auth endpoint.

Related errors

• Timed out after {} minutes waiting for the login to be confi
• Login was denied in the browser.
• the confirmation code expired before it was used; run `baml
• Auth server returned {status}: {body}
• not logged in; run `baml auth login`

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/9ba06b6b599999c3. Report an issue: GitHub.