Hmbown/CodeWhale · error

xAI OAuth access token in {} is expired. Read-only consent n

Error message

xAI OAuth access token in {} is expired. Read-only consent never refreshes or rewrites another CLI's credentials. Run `grok login` again or use `codewhale auth xai-device`.

What it means

Error "xAI OAuth access token in {} is expired. Read-only consent never refreshes or rewrites another CLI's credentials. Run `grok login` again or use `codewhale auth xai-device`." thrown in Hmbown/CodeWhale.

Source

Thrown at crates/tui/src/xai_oauth.rs:395

    if load_owned_auth_file(&owned_path)?.is_some() {
        return get_owned_credentials(&owned_path);
    }

    let external_path = auth_file_path();
    let grant = config.external_credential_read_grant(
        ApiProvider::Xai,
        codewhale_config::ExternalCredentialSource::GrokCli,
        &external_path,
    )?;
    let mut file = load_external_auth_file(&grant)?;
    let (scope, entry) = select_entry(&mut file).ok_or_else(|| {
        anyhow::anyhow!(
            "xAI OAuth credentials at {} have no usable entry. Run `grok login` again or use `codewhale auth xai-device` for Codewhale-owned storage.",
            codewhale_config::quote_os_path(grant.path())
        )
    })?;
    if !entry_access_token_is_fresh(&entry) {
        bail!(
            "xAI OAuth access token in {} is expired. Read-only consent never refreshes or rewrites another CLI's credentials. Run `grok login` again or use `codewhale auth xai-device`.",
            codewhale_config::quote_os_path(grant.path())
        );
    }
    let token = entry
        .key
        .clone()
        .filter(|token| !token.trim().is_empty())
        .context("xAI OAuth access token is empty")?;
    Ok(credentials_from_entry(scope, &entry, token))
}

fn get_owned_credentials(path: &Path) -> Result<XaiOAuthCredentials> {
    let directory = codewhale_config::xai_oauth_credentials_dir()?;
    anyhow::ensure!(
        path.parent() == Some(directory.as_path()),
        "Codewhale-owned xAI OAuth path escaped the credentials directory"
    );

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Run `grok login` again to obtain fresh read-only credentials in the external file
2. Use `codewhale auth xai-device` to establish CodeWhale-owned device credentials that can refresh
3. Switch to owned credentials stored under the CodeWhale home so rotation is managed

When it happens

Trigger: Thrown at crates/tui/src/xai_oauth.rs:395 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/61885e7521bf838b. Report an issue: GitHub.