Wei-Shaw/sub2api · error

xAI OAuth response exceeds 2 MiB

Error message

xAI OAuth response exceeds 2 MiB

What it means

The SSO HTTP helper reads at most ssoMaxAuthBody+1 bytes (2 MiB) from any OAuth response; reading more than 2 MiB produces this error. OAuth endpoints should return small JSON/HTML payloads, so an oversized body almost always means the endpoint returned something unexpected (a huge HTML page, an error wall, or a looping redirect body).

Source

Thrown at backend/internal/pkg/xai/sso_device.go:281

		if cookie := f.cookieHeader(request.URL); cookie != "" {
			request.Header.Set("Cookie", cookie)
		}
		if currentForm != nil {
			request.Header.Set("Content-Type", "application/x-www-form-urlencoded")
		}

		response, err := f.client.Do(request)
		if err != nil {
			return 0, currentURL, nil, err
		}
		f.captureCookies(request.URL, response)
		data, readErr := io.ReadAll(io.LimitReader(response.Body, ssoMaxAuthBody+1))
		_ = response.Body.Close()
		if readErr != nil {
			return response.StatusCode, currentURL, nil, readErr
		}
		if len(data) > ssoMaxAuthBody {
			return response.StatusCode, currentURL, nil, errors.New("xAI OAuth response exceeds 2 MiB")
		}
		if response.StatusCode < 300 || response.StatusCode > 399 {
			return response.StatusCode, currentURL, data, nil
		}

		location := strings.TrimSpace(response.Header.Get("Location"))
		if location == "" {
			return response.StatusCode, currentURL, data, errors.New("xAI OAuth redirect missing Location")
		}
		base, _ := url.Parse(currentURL)
		next, err := url.Parse(location)
		if err != nil {
			return response.StatusCode, currentURL, data, err
		}
		currentURL = base.ResolveReference(next).String()
		if !safeXAIAuthURL(currentURL) {
			return response.StatusCode, currentURL, data, errors.New("xAI OAuth redirected to untrusted host")
		}

View on GitHub (pinned to 073e92d171)

Solutions

1. Retry after a short delay to rule out a transient block page.
2. Bypass corporate proxies / SSL inspection for the xAI OAuth hosts.
3. Hit the failing endpoint manually with the same cookies to see what the huge body actually is.
4. If the block is persistent (WAF rule on your egress IP), change egress IP or contact the provider.

if err != nil && strings.Contains(err.Error(), "exceeds 2 MiB") {
    time.Sleep(2 * time.Second)
    err = flow.Start(ctx) // WAF/block pages are usually transient
}

When it happens

Trigger: Any request in the device flow (start, verify, approve, token) whose response body exceeds 2 MiB: xAI serving a large challenge/captcha page, a WAF returning a bloated block page, or a proxy injecting content.

Common situations: Cloudflare/WAF block pages; misconfigured hosts returning full SPA bundles; corporate SSL-inspection proxies appending content; xAI incident serving error pages.

Related errors

• xAI OAuth redirect missing Location
• xai sso unauthorized
• xAI device flow response is incomplete
• xAI device verification did not reach consent page
• xAI device approval did not reach done page

AI-assisted analysis of Wei-Shaw/sub2api@073e92d171 (2026-08-15). Data as JSON: /api/errors/1768d971d485b666. Report an issue: GitHub.