Wei-Shaw/sub2api · error

xAI device verification did not reach consent page

Error message

xAI device verification did not reach consent page

What it means

After GET-ing the verification_uri_complete and POST-ing the user_code to the verify endpoint, the flow checks that the final (post-redirect) URL contains 'consent'. If it does not, xAI did not land the session on the consent page, meaning the user_code was rejected, the session is not authenticated, or the flow was redirected somewhere unexpected (e.g. a login page).

Source

Thrown at backend/internal/pkg/xai/sso_device.go:158

	}

	status, _, _, err = f.do(ctx, http.MethodGet, device.VerificationURIComplete, nil)
	if err != nil {
		return nil, err
	}
	if status < 200 || status >= 400 {
		return nil, fmt.Errorf("open xAI device verification page: %w", SSOHTTPError{Status: status})
	}

	status, finalURL, _, err = f.do(ctx, http.MethodPost, SSOVerifyURL, url.Values{"user_code": {device.UserCode}})
	if err != nil {
		return nil, err
	}
	if status < 200 || status >= 400 {
		return nil, fmt.Errorf("verify xAI device code: %w", SSOHTTPError{Status: status})
	}
	if !strings.Contains(finalURL, "consent") {
		return nil, errors.New("xAI device verification did not reach consent page")
	}

	status, finalURL, _, err = f.do(ctx, http.MethodPost, SSOApproveURL, url.Values{
		"user_code":      {device.UserCode},
		"action":         {"allow"},
		"principal_type": {"User"},
		"principal_id":   {""},
	})
	if err != nil {
		return nil, err
	}
	if status < 200 || status >= 400 {
		return nil, fmt.Errorf("approve xAI device code: %w", SSOHTTPError{Status: status})
	}
	if !strings.Contains(finalURL, "done") {
		return nil, errors.New("xAI device approval did not reach done page")
	}

View on GitHub (pinned to 073e92d171)

Solutions

1. Verify the session token is still valid by hitting an authenticated xAI endpoint first.
2. Ensure the http.Client used by the flow has a working cookie jar and that seedSSOCookies ran.
3. Retry with a brand-new device flow (fresh user_code).
4. If persistent, xAI likely changed the flow: log the final URL to see where it landed and adjust the 'consent' check.

Example fix

// before
if !strings.Contains(finalURL, "consent") {
    return nil, errors.New("xAI device verification did not reach consent page")
}

// after (diagnostics: record where it actually landed)
if !strings.Contains(finalURL, "consent") {
    return nil, fmt.Errorf("xAI device verification did not reach consent page (landed on %s)", finalURL)
}

if err := flow.Start(ctx); err != nil {
    if strings.Contains(err.Error(), "did not reach consent page") {
        // stale cookies or unauthenticated session: restart with fresh flow + token
        return restartFlowWithFreshToken()
    }
    return err
}

When it happens

Trigger: The POST to SSOVerifyURL succeeds HTTP-wise but redirects to a login/challenge page instead of the consent page: expired or mistyped user_code, session cookies not accepted, xAI adding an intermediate step (captcha, email verification), or a redirect loop that ends elsewhere.

Common situations: SSO session token invalidated between start and verify; xAI deploys an extra auth step; cookie jar not seeded correctly (seedSSOCookies skipped or cookie policy blocking them); region-specific consent variants that use a different URL keyword.

Related errors

• xAI device approval did not reach done page
• xAI device flow response is incomplete
• xAI device flow token polling timed out
• xAI OAuth redirect missing Location
• xAI OAuth redirected to untrusted host

AI-assisted analysis of Wei-Shaw/sub2api@073e92d171 (2026-08-15). Data as JSON: /api/errors/1de364c183086ab0. Report an issue: GitHub.