Hmbown/CodeWhale · error

xAI OIDC discovery issuer does not match the requested issue

Error message

xAI OIDC discovery issuer does not match the requested issuer

What it means

Thrown by validate_discovered_issuer when the issuer field returned by xAI's OIDC discovery document, after trimming whitespace and trailing slashes, differs from the issuer the client requested. This is a trust check: discovery responses are untrusted network data, and an issuer mismatch means the document may belong to (or have been substituted for) a different authority than the one authentication is intended for.

Source

Thrown at crates/tui/src/xai_oauth.rs:1063

            "device_authorization_endpoint",
            issuer,
        )?,
        token_endpoint: validate_discovered_oauth_endpoint(
            discovery.token_endpoint,
            "token_endpoint",
            issuer,
        )?,
    })
}

fn validate_discovered_issuer(discovered: Option<String>, expected: &str) -> Result<()> {
    let discovered = discovered
        .as_deref()
        .map(str::trim)
        .filter(|issuer| !issuer.is_empty())
        .context("xAI OIDC discovery missing issuer")?;
    if discovered.trim_end_matches('/') != expected.trim_end_matches('/') {
        bail!("xAI OIDC discovery issuer does not match the requested issuer");
    }
    Ok(())
}

fn validate_discovered_oauth_endpoint(
    endpoint: Option<String>,
    field: &str,
    issuer: &str,
) -> Result<String> {
    let endpoint = endpoint
        .as_deref()
        .map(str::trim)
        .filter(|endpoint| !endpoint.is_empty())
        .with_context(|| format!("xAI OIDC discovery missing {field}"))?;
    let parsed = reqwest::Url::parse(endpoint)
        .with_context(|| format!("xAI OIDC discovery returned an invalid {field}"))?;
    if !matches!(parsed.scheme(), "http" | "https") {
        bail!("xAI OIDC discovery returned unsupported {field} scheme");

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Verify the configured xAI issuer URL is correct and has no stray trailing slash, path, or typo
2. Check network/DNS for interception (corporate proxy, /etc/hosts) that could serve a different discovery document
3. Retry login; if the mismatch persists, capture the discovery document and confirm its issuer with xAI support
4. Fall back to XAI_API_KEY authentication instead of OAuth

When it happens

Trigger: Thrown at crates/tui/src/xai_oauth.rs:1063 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/e7a445914e78c033. Report an issue: GitHub.