{"record":{"id":"1feb3166c7379a91","repo":"BerriAI/litellm","slug":"xai-oauth-discovery-returned-unexpected-endpoint","errorCode":null,"errorMessage":"xAI OAuth discovery returned unexpected endpoint: {url}","messagePattern":"xAI OAuth discovery returned unexpected endpoint: (.+?)","errorType":"exception","errorClass":"XAIOAuthError","httpStatus":null,"severity":"error","filePath":"litellm/llms/xai/oauth.py","lineNumber":253,"sourceCode":"            ) from exc\n        try:\n            data: Final = response.json()\n        except ValueError as exc:\n            raise XAIOAuthError(\"xAI OAuth discovery response was not valid JSON\") from exc\n        authorization_endpoint: Final = data.get(\"authorization_endpoint\")\n        token_endpoint: Final = data.get(\"token_endpoint\")\n        if not authorization_endpoint or not token_endpoint:\n            raise XAIOAuthError(\"xAI OAuth discovery missing endpoints\")\n        return {\n            \"authorization_endpoint\": self._validate_xai_endpoint(authorization_endpoint),\n            \"token_endpoint\": self._validate_xai_endpoint(token_endpoint),\n        }\n\n    def _validate_xai_endpoint(self, url: str) -> str:\n        parsed: Final = urlparse(url)\n        host: Final = (parsed.hostname or \"\").lower()\n        if parsed.scheme != \"https\" or (host != \"x.ai\" and not host.endswith(\".x.ai\")):\n            raise XAIOAuthError(f\"xAI OAuth discovery returned unexpected endpoint: {url}\")\n        return url\n\n    def _pkce_pair(self) -> tuple[str, str]:\n        verifier: Final = base64.urlsafe_b64encode(secrets.token_bytes(32)).rstrip(b\"=\").decode()\n        challenge: Final = base64.urlsafe_b64encode(hashlib.sha256(verifier.encode()).digest()).rstrip(b\"=\").decode()\n        return verifier, challenge\n\n    def _start_callback_server(self, state: str) -> tuple[_CallbackServer, str]:\n        last_error: OSError | None = None\n        for port in (XAI_OAUTH_REDIRECT_PORT, 0):\n            try:\n                server = _CallbackServer((XAI_OAUTH_REDIRECT_HOST, port), _CallbackHandler)\n                server.expected_state = state\n                server.callback_result = None\n                actual_port = server.server_address[1]\n                redirect_uri = f\"http://{XAI_OAUTH_REDIRECT_HOST}:{actual_port}{XAI_OAUTH_REDIRECT_PATH}\"\n                return server, redirect_uri\n            except OSError as exc:","sourceCodeStart":235,"sourceCodeEnd":271,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/llms/xai/oauth.py#L235-L271","documentation":"XAIOAuthError from endpoint validation: a discovered authorization or token endpoint URL failed the xAI-origin check (wrong scheme/host), so it is refused to prevent the OAuth flow from being pointed at an arbitrary server.","triggerScenarios":"Thrown at litellm/llms/xai/oauth.py:253 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Check the unexpected endpoint URL in the error; litellm rejects endpoints that do not match the expected xAI hosts.","If xAI changed hosts legitimately, upgrade litellm; otherwise investigate possible DNS/proxy tampering."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}