BoundaryML/baml · error

Auth server returned

Error message

Auth server returned {status}: {value}

What it means

Catch-all branch of poll_token_endpoint: the token endpoint returned an unrecognized `error` value (anything besides authorization_pending, slow_down, access_denied, expired_token), so the CLI bails echoing the HTTP status and raw error payload. It signals an unexpected condition from the auth server.

Solutions

1. Read the echoed status and value to identify the server-side error.
2. Verify the auth endpoint/region configuration is correct and up to date.
3. Update the BAML CLI to a version that knows the new error code.
4. Retry later if the auth server is degraded (5xx status).

match baml_cli::auth::device_login(...) {
    Err(e) if e.to_string().contains("Auth server returned") => {
        // log full context; retry with backoff or report to server operator
        eprintln!("{e:#}");
        retry_with_backoff(|| baml_cli::auth::device_login(...), 3)?;
    }
    r => r?,
}

When it happens

Trigger: device_login -> poll_token_endpoint receiving a token response whose `error` field matches none of the known device-flow error codes.

Common situations: Auth server version drift introducing new error codes (e.g. invalid_client, invalid_scope, server errors surfaced as the error field); proxy/gateway injecting error pages; pointing the CLI at a custom/wrong auth endpoint.

Related errors

• Login was denied in the browser.
• the confirmation code expired before it was used; run `baml…
• Timed out after minutes waiting for the login to be…
• Auth server returned
• No credentials found

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/9ba06b6b599999c3. Report an issue: GitHub.

Appendix: source

Thrown at baml_language/crates/baml_cli/src/auth.rs:403

            .json()
            .context("Failed to parse token endpoint response")?;

        if status.is_success() {
            return serde_json::from_value(value).context("Failed to parse token response");
        }

        let error = value.get("error").and_then(|e| e.as_str()).unwrap_or("");
        match error {
            "authorization_pending" => std::thread::sleep(interval),
            "slow_down" => {
                interval += Duration::from_secs(5);
                std::thread::sleep(interval);
            }
            "access_denied" => anyhow::bail!("Login was denied in the browser."),
            "expired_token" => anyhow::bail!(
                "the confirmation code expired before it was used; run `baml auth login` again"
            ),
            _ => anyhow::bail!("Auth server returned {status}: {value}"),
        }
    }
}

// ---------------------------------------------------------------------------
// Request plumbing
// ---------------------------------------------------------------------------

/// WorkOS authenticate response. Field presence varies by grant, so
/// everything but `access_token` is optional.
#[derive(Debug, Deserialize)]
struct TokenResponse {
    access_token: String,
    refresh_token: Option<String>,
    expires_in: Option<u64>,
    user: Option<TokenUser>,
}

View on GitHub (pinned to bd85ce9dee)