Wei-Shaw/sub2api · error

xAI device verification did not reach consent page

Error message

xAI device verification did not reach consent page

What it means

After GET-ing the verification_uri_complete and POST-ing the user_code to the verify endpoint, the flow checks that the final (post-redirect) URL contains 'consent'. If it does not, xAI did not land the session on the consent page, meaning the user_code was rejected, the session is not authenticated, or the flow was redirected somewhere unexpected (e.g. a login page).

Solutions

1. Verify the session token is still valid by hitting an authenticated xAI endpoint first.
2. Ensure the http.Client used by the flow has a working cookie jar and that seedSSOCookies ran.
3. Retry with a brand-new device flow (fresh user_code).
4. If persistent, xAI likely changed the flow: log the final URL to see where it landed and adjust the 'consent' check.

Example fix

// before
if !strings.Contains(finalURL, "consent") {
    return nil, errors.New("xAI device verification did not reach consent page")
}

// after (diagnostics: record where it actually landed)
if !strings.Contains(finalURL, "consent") {
    return nil, fmt.Errorf("xAI device verification did not reach consent page (landed on %s)", finalURL)
}

if err := flow.Start(ctx); err != nil {
    if strings.Contains(err.Error(), "did not reach consent page") {
        // stale cookies or unauthenticated session: restart with fresh flow + token
        return restartFlowWithFreshToken()
    }
    return err
}

When it happens

Trigger: The POST to SSOVerifyURL succeeds HTTP-wise but redirects to a login/challenge page instead of the consent page: expired or mistyped user_code, session cookies not accepted, xAI adding an intermediate step (captcha, email verification), or a redirect loop that ends elsewhere.

Common situations: SSO session token invalidated between start and verify; xAI deploys an extra auth step; cookie jar not seeded correctly (seedSSOCookies skipped or cookie policy blocking them); region-specific consent variants that use a different URL keyword.

Related errors

• xAI device approval did not reach done page
• xAI device flow response is incomplete
• xAI device flow token polling timed out
• xAI OAuth redirect missing Location
• xAI OAuth redirected to untrusted host

AI-assisted analysis of Wei-Shaw/sub2api@073e92d171 (2026-08-15). Data as JSON: /api/errors/1de364c183086ab0. Report an issue: GitHub.

Appendix: source

Thrown at backend/internal/pkg/xai/sso_device.go:158

	}

	status, _, _, err = f.do(ctx, http.MethodGet, device.VerificationURIComplete, nil)
	if err != nil {
		return nil, err
	}
	if status < 200 || status >= 400 {
		return nil, fmt.Errorf("open xAI device verification page: %w", SSOHTTPError{Status: status})
	}

	status, finalURL, _, err = f.do(ctx, http.MethodPost, SSOVerifyURL, url.Values{"user_code": {device.UserCode}})
	if err != nil {
		return nil, err
	}
	if status < 200 || status >= 400 {
		return nil, fmt.Errorf("verify xAI device code: %w", SSOHTTPError{Status: status})
	}
	if !strings.Contains(finalURL, "consent") {
		return nil, errors.New("xAI device verification did not reach consent page")
	}

	status, finalURL, _, err = f.do(ctx, http.MethodPost, SSOApproveURL, url.Values{
		"user_code":      {device.UserCode},
		"action":         {"allow"},
		"principal_type": {"User"},
		"principal_id":   {""},
	})
	if err != nil {
		return nil, err
	}
	if status < 200 || status >= 400 {
		return nil, fmt.Errorf("approve xAI device code: %w", SSOHTTPError{Status: status})
	}
	if !strings.Contains(finalURL, "done") {
		return nil, errors.New("xAI device approval did not reach done page")
	}

View on GitHub (pinned to 073e92d171)