Hmbown/CodeWhale · error

xAI OIDC discovery returned unsupported {field} scheme

Error message

xAI OIDC discovery returned unsupported {field} scheme

What it means

Guard inside validate_discovered_oauth_endpoint: after parsing a discovered endpoint (e.g. token_endpoint or device_authorization_endpoint), its URL scheme must be http or https. Any other scheme (ftp:, file:, data:, javascript:, etc.) is rejected because the endpoint would be unusable for OAuth HTTP traffic or could smuggle non-HTTP semantics. The named {field} in the discovery document is the faulty input.

Source

Thrown at crates/tui/src/xai_oauth.rs:1081

        bail!("xAI OIDC discovery issuer does not match the requested issuer");
    }
    Ok(())
}

fn validate_discovered_oauth_endpoint(
    endpoint: Option<String>,
    field: &str,
    issuer: &str,
) -> Result<String> {
    let endpoint = endpoint
        .as_deref()
        .map(str::trim)
        .filter(|endpoint| !endpoint.is_empty())
        .with_context(|| format!("xAI OIDC discovery missing {field}"))?;
    let parsed = reqwest::Url::parse(endpoint)
        .with_context(|| format!("xAI OIDC discovery returned an invalid {field}"))?;
    if !matches!(parsed.scheme(), "http" | "https") {
        bail!("xAI OIDC discovery returned unsupported {field} scheme");
    }
    let issuer = reqwest::Url::parse(issuer).context("xAI OIDC issuer is not a valid URL")?;
    if issuer.scheme() == "https" && parsed.scheme() != "https" {
        bail!("xAI OIDC discovery attempted to downgrade {field} from HTTPS");
    }
    if !parsed.username().is_empty() || parsed.password().is_some() {
        bail!("xAI OIDC discovery returned credentials in {field}");
    }
    if parsed.origin() != issuer.origin() {
        bail!("xAI OIDC discovery returned {field} on a different origin than the issuer");
    }
    Ok(endpoint.to_string())
}

fn parse_oauth_json_response<T: DeserializeOwned>(
    response: reqwest::blocking::Response,
    operation: &str,
) -> Result<(reqwest::StatusCode, T)> {

View on GitHub (pinned to 0c42157ee5)

Solutions

1. Retry discovery to rule out a transient corrupted response
2. Inspect the xAI discovery document and confirm the listed endpoints use https URLs
3. Check for proxies or middleboxes that could rewrite the discovery response; bypass them and retry
4. If xAI genuinely advertises a bad endpoint, report it and use XAI_API_KEY in the meantime

When it happens

Trigger: Thrown at crates/tui/src/xai_oauth.rs:1081 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of Hmbown/CodeWhale@0c42157ee5 (2026-08-20). Data as JSON: /api/errors/30251f20f79da7fa. Report an issue: GitHub.