BoundaryML/baml · error

Login was denied in the browser.

Error message

Login was denied in the browser.

What it means

The OAuth device-flow token endpoint returned error="access_denied", meaning the user explicitly clicked deny/refused the login request in the browser. poll_token_endpoint converts that into a bail; the CLI cannot proceed without re-initiating login.

Source

Thrown at baml_language/crates/baml_cli/src/auth.rs:399

            .send()
            .context("Failed to reach the auth server")?;
        let status = resp.status();
        let value: serde_json::Value = resp
            .json()
            .context("Failed to parse token endpoint response")?;

        if status.is_success() {
            return serde_json::from_value(value).context("Failed to parse token response");
        }

        let error = value.get("error").and_then(|e| e.as_str()).unwrap_or("");
        match error {
            "authorization_pending" => std::thread::sleep(interval),
            "slow_down" => {
                interval += Duration::from_secs(5);
                std::thread::sleep(interval);
            }
            "access_denied" => anyhow::bail!("Login was denied in the browser."),
            "expired_token" => anyhow::bail!(
                "the confirmation code expired before it was used; run `baml auth login` again"
            ),
            _ => anyhow::bail!("Auth server returned {status}: {value}"),
        }
    }
}

// ---------------------------------------------------------------------------
// Request plumbing
// ---------------------------------------------------------------------------

/// WorkOS authenticate response. Field presence varies by grant, so
/// everything but `access_token` is optional.
#[derive(Debug, Deserialize)]
struct TokenResponse {
    access_token: String,
    refresh_token: Option<String>,

View on GitHub (pinned to bd85ce9dee)

Solutions

1. Re-run `baml auth login` and click Allow/Approve on the consent screen.
2. Confirm you are authenticating in a browser session under your own account.
3. If an org policy auto-denies consent, ask IT to allow the BAML CLI OAuth client.

match baml_cli::auth::device_login(...) {
    Err(e) if e.to_string().contains("denied in the browser") => {
        eprintln!("Login denied; re-running and please click Allow this time...");
        baml_cli::auth::device_login(...)?;
    }
    r => r?,
}

When it happens

Trigger: device_login -> poll_token_endpoint receiving a response whose `error` field equals "access_denied" while polling for the token.

Common situations: User hit "Cancel"/"Deny" on the consent page; a shared machine's other user denied the prompt; corporate security tooling auto-denies consent screens.

Related errors

• Timed out after {} minutes waiting for the login to be confi
• the confirmation code expired before it was used; run `baml
• Auth server returned {status}: {value}
• Auth server returned {status}: {body}
• not logged in; run `baml auth login`

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/5ee3a70fb24786aa. Report an issue: GitHub.