{"record":{"id":"18005b1c05d62dff","repo":"can1357/oh-my-pi","slug":"device-authorization-initiation-failed-initresp","errorCode":null,"errorMessage":"Device authorization initiation failed: ${initResponse.status}","messagePattern":"Device authorization initiation failed: (.+?)","errorType":"exception","errorClass":"AIError.OAuthError","httpStatus":null,"severity":"error","filePath":"packages/ai/src/registry/oauth/openai-codex.ts","lineNumber":259,"sourceCode":"\n/**\n * Login with OpenAI Codex using the device-code (headless) flow.\n *\n * Avoids a local callback server entirely — useful when port 1455 is unavailable\n * or when the browser callback flow fails with 403 (e.g. network/proxy issues).\n */\nexport async function loginOpenAICodexDevice(ctrl: OAuthController): Promise<OAuthCredentials> {\n\tctrl.onProgress?.(\"Initiating device authorization…\");\n\n\tconst initResponse = await fetch(DEVICE_USERCODE_URL, {\n\t\tmethod: \"POST\",\n\t\theaders: { \"Content-Type\": \"application/json\" },\n\t\tbody: JSON.stringify({ client_id: CLIENT_ID }),\n\t\tsignal: AbortSignal.timeout(TOKEN_REQUEST_TIMEOUT_MS),\n\t});\n\n\tif (!initResponse.ok) {\n\t\tthrow new AIError.OAuthError(`Device authorization initiation failed: ${initResponse.status}`, {\n\t\t\tkind: \"device-auth\",\n\t\t\tstatus: initResponse.status,\n\t\t});\n\t}\n\n\tconst initData = (await initResponse.json()) as {\n\t\tdevice_auth_id?: string;\n\t\tuser_code?: string;\n\t\tinterval?: string | number;\n\t};\n\n\tif (!initData.device_auth_id || !initData.user_code) {\n\t\tthrow new AIError.OAuthError(\"Device authorization response missing required fields\", { kind: \"validation\" });\n\t}\n\n\tconst userCode = initData.user_code;\n\tconst pollIntervalMs =\n\t\t(typeof initData.interval === \"number\"","sourceCodeStart":241,"sourceCodeEnd":277,"githubUrl":"https://github.com/can1357/oh-my-pi/blob/969062200754ea02cfac922e5ebb8c608c079e15/packages/ai/src/registry/oauth/openai-codex.ts#L241-L277","documentation":"Thrown by loginOpenAICodexDevice when the initial device-authorization request (POST to the device auth endpoint with the client_id) returns a non-ok HTTP status. Classified kind='device-auth' with the status attached, it means the device flow could not even be started — no user_code or verification URL was issued.","triggerScenarios":"OpenAI rejects the client_id (CLI version predates a client rotation); 4xx for malformed request or blocked client; 429 rate limiting after many login attempts; 5xx from an OpenAI outage; a proxy/agent blocking the POST. Runs with a TOKEN_REQUEST_TIMEOUT_MS abort signal, though timeouts surface as abort errors rather than this message.","commonSituations":"Outdated CLI after OpenAI rotated OAuth clients; corporate firewall/proxy intercepting auth.openai.com; hammering login repeatedly and tripping rate limits; OpenAI incident making the device endpoint unavailable.","solutions":["Check the embedded HTTP status: 401/403 points to client_id problems (update the CLI); 429 means wait and retry; 5xx means OpenAI-side trouble","Update the CLI to the latest release","Verify network access to the OpenAI auth endpoint from this machine (curl the URL, check proxy settings)","Wait a few minutes and retry if rate-limited"],"exampleFix":"// before: bare call crashes on transient failure\nconst auth = await loginOpenAICodexDevice();\n// after: retry 5xx once\nlet auth;\ntry { auth = await loginOpenAICodexDevice(); }\ncatch (e) {\n  if (e instanceof AIError.OAuthError && /: 5\\d\\d$/.test(e.message)) auth = await loginOpenAICodexDevice();\n  else throw e;\n}","handlingStrategy":"retry","validationCode":"// pre-flight network check before starting the device flow\nconst probe = await fetch('https://auth.openai.com/.well-known/openid-configuration', { signal: AbortSignal.timeout(5000) }).catch(() => null);\nif (!probe || !probe.ok) throw new Error('OpenAI auth endpoint unreachable — check network/proxy before login');","typeGuard":null,"tryCatchPattern":"try {\n  const auth = await loginOpenAICodexDevice();\n} catch (e) {\n  if (e instanceof AIError.OAuthError && e.kind === 'device-auth') {\n    if ((e.status ?? 0) >= 500 || e.status === 429) {\n      await Bun.sleep(5000); // retry after backoff\n    } else {\n      // 401/403: update CLI (client_id rejected)\n    }\n  } else throw e;\n}","preventionTips":["Keep the CLI updated so the embedded client_id is accepted","Verify corporate proxies/firewalls don't block auth.openai.com POSTs","Back off after repeated attempts to avoid 429 rate limits","Check OpenAI status page when 5xx statuses appear"],"tags":["oauth","openai-codex","device-flow","http-error"],"backgroundTag":"oauth-device-init-failed","analyzedSha":"969062200754ea02cfac922e5ebb8c608c079e15","analyzedAt":"2026-08-31T10:29:35.737Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}