the confirmation code expired before it was used; run `baml

Error message

the confirmation code expired before it was used; run `baml auth login` again

What it means

The device-flow confirmation code expired before being used: the token endpoint returned error="expired_token". Device codes have a short lifetime; once expired, the login attempt must be restarted from scratch.

Source

Thrown at baml_language/crates/baml_cli/src/auth.rs:400

            .context("Failed to reach the auth server")?;
        let status = resp.status();
        let value: serde_json::Value = resp
            .json()
            .context("Failed to parse token endpoint response")?;

        if status.is_success() {
            return serde_json::from_value(value).context("Failed to parse token response");
        }

        let error = value.get("error").and_then(|e| e.as_str()).unwrap_or("");
        match error {
            "authorization_pending" => std::thread::sleep(interval),
            "slow_down" => {
                interval += Duration::from_secs(5);
                std::thread::sleep(interval);
            }
            "access_denied" => anyhow::bail!("Login was denied in the browser."),
            "expired_token" => anyhow::bail!(
                "the confirmation code expired before it was used; run `baml auth login` again"
            ),
            _ => anyhow::bail!("Auth server returned {status}: {value}"),
        }
    }
}

// ---------------------------------------------------------------------------
// Request plumbing
// ---------------------------------------------------------------------------

/// WorkOS authenticate response. Field presence varies by grant, so
/// everything but `access_token` is optional.
#[derive(Debug, Deserialize)]
struct TokenResponse {
    access_token: String,
    refresh_token: Option<String>,
    expires_in: Option<u64>,

View on GitHub (pinned to bd85ce9dee)

Solutions

Run `baml auth login` again and complete the browser step immediately.
Copy-paste the confirmation code rather than retyping it slowly.
Check clock skew (system time) if codes seem to expire instantly.

Defensive patterns

Strategy: retry

Try / catch

match baml_cli::auth::device_login(...) {
    Err(e) if e.to_string().contains("confirmation code expired") => {
        eprintln!("Code expired; restarting login...");
        baml_cli::auth::device_login(...)?;
    }
    r => r?,
}

Prevention

Act on the URL/code as soon as it is printed.
Paste the code instead of typing it manually.
Keep system clocks synced (NTP) to avoid premature expiry.
Increase device-code lifetime if you operate a custom auth server.

When it happens

Trigger: device_login -> poll_token_endpoint receiving error="expired_token" from the token endpoint while polling.

Common situations: Waiting too long before opening the URL or entering the code; leaving the login prompt idle during a meeting/lunch; very short-lived codes on a self-hosted auth server.

Related errors

AI-assisted analysis of BoundaryML/baml@bd85ce9dee (2026-09-12). Data as JSON: /api/errors/c90dbd347dcf5906. Report an issue: GitHub.