Hmbown/CodeWhale · error

xAI OIDC discovery returned credentials in {field}

Error message

xAI OIDC discovery returned credentials in {field}

What it means

Credential-hygiene guard in validate_discovered_oauth_endpoint: the parsed URL for {field} must not carry userinfo (user:pass@host). Credentials embedded in a discovered endpoint would leak into logs, history, and every subsequent request, so their presence is treated as a malformed or hostile discovery document rather than being silently stripped.

Source

Thrown at crates/tui/src/xai_oauth.rs:1088

    field: &str,
    issuer: &str,
) -> Result<String> {
    let endpoint = endpoint
        .as_deref()
        .map(str::trim)
        .filter(|endpoint| !endpoint.is_empty())
        .with_context(|| format!("xAI OIDC discovery missing {field}"))?;
    let parsed = reqwest::Url::parse(endpoint)
        .with_context(|| format!("xAI OIDC discovery returned an invalid {field}"))?;
    if !matches!(parsed.scheme(), "http" | "https") {
        bail!("xAI OIDC discovery returned unsupported {field} scheme");
    }
    let issuer = reqwest::Url::parse(issuer).context("xAI OIDC issuer is not a valid URL")?;
    if issuer.scheme() == "https" && parsed.scheme() != "https" {
        bail!("xAI OIDC discovery attempted to downgrade {field} from HTTPS");
    }
    if !parsed.username().is_empty() || parsed.password().is_some() {
        bail!("xAI OIDC discovery returned credentials in {field}");
    }
    if parsed.origin() != issuer.origin() {
        bail!("xAI OIDC discovery returned {field} on a different origin than the issuer");
    }
    Ok(endpoint.to_string())
}

fn parse_oauth_json_response<T: DeserializeOwned>(
    response: reqwest::blocking::Response,
    operation: &str,
) -> Result<(reqwest::StatusCode, T)> {
    let status = response.status();
    let content_type = response
        .headers()
        .get(reqwest::header::CONTENT_TYPE)
        .and_then(|value| value.to_str().ok())
        .unwrap_or("missing")
        .to_string();

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Retry discovery to rule out a corrupted or tampered response
2. Check for proxies or rewritten discovery responses that inject userinfo into endpoint URLs
3. Confirm with xAI that their discovery document does not embed credentials; use XAI_API_KEY while unresolved

When it happens

Trigger: Thrown at crates/tui/src/xai_oauth.rs:1088 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/3320a12ecf1fdb8e. Report an issue: GitHub.