{"record":{"id":"33c3ae7328f7a642","repo":"Hmbown/CodeWhale","slug":"xai-oauth-refresh-failed-err-run-grok-login","errorCode":null,"errorMessage":"xAI OAuth refresh failed ({err}). Run `grok login` or device-code login again. If SuperGrok OAuth returns HTTP 403, use XAI_API_KEY instead.","messagePattern":"xAI OAuth refresh failed \\((.+?)\\)\\. Run `grok login` or device-code login again\\. If SuperGrok OAuth returns HTTP 403, use XAI_API_KEY instead\\.","errorType":"http","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/tui/src/xai_oauth.rs","lineNumber":1203,"sourceCode":"    let params = [\n        (\"client_id\", client_id),\n        (\"grant_type\", \"refresh_token\"),\n        (\"refresh_token\", refresh_token),\n    ];\n    #[cfg(test)]\n    crate::external_credentials::record_oauth_network();\n    let response = client\n        .post(token_endpoint)\n        .form(&params)\n        .send()\n        .context(\"xAI OAuth refresh request failed\")?;\n    let (status, body): (_, TokenResponse) =\n        parse_oauth_json_response(response, \"xAI OAuth refresh\")?;\n    if !status.is_success() || body.error.is_some() {\n        // Refresh requests carry a credential. Do not echo a server-provided\n        // description that could reflect the submitted refresh token.\n        let err = oauth_failure_detail(body.error.as_deref(), None, status);\n        bail!(\n            \"xAI OAuth refresh failed ({err}). Run `grok login` or device-code login again. \\\n             If SuperGrok OAuth returns HTTP 403, use XAI_API_KEY instead.\"\n        );\n    }\n    Ok(body)\n}\n\nfn request_device_code(\n    device_authorization_endpoint: &str,\n    client_id: &str,\n    scopes: &str,\n) -> Result<DeviceCodeGrant> {\n    let client = crate::tls::reqwest_blocking_client_builder()\n        .timeout(Duration::from_secs(20))\n        .build()\n        .context(\"Failed to build xAI device-code client\")?;\n    let params = [(\"client_id\", client_id), (\"scope\", scopes)];\n    #[cfg(test)]","sourceCodeStart":1185,"sourceCodeEnd":1221,"githubUrl":"https://github.com/Hmbown/CodeWhale/blob/0c42157ee52f9d55af2b506d71b46249910f77d3/crates/tui/src/xai_oauth.rs#L1185-L1221","documentation":"Terminal failure of the xAI OAuth refresh-token grant: the token endpoint answered, but with a non-success status or an OAuth error body. Because the request carried a credential, the underlying {err} detail is deliberately not echoed beyond this formatted message. The message also encodes the recovery paths: re-authenticate via `grok login` or device-code login, and notes that SuperGrok OAuth can return HTTP 403 where XAI_API_KEY works.","triggerScenarios":"Thrown at crates/tui/src/xai_oauth.rs:1203 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Run `grok login` or start device-code login again to obtain fresh tokens","If the detail mentions HTTP 403 from SuperGrok OAuth, switch to XAI_API_KEY authentication","Check system time skew and network access to the xAI token endpoint, then retry once","If the error indicates an invalid_grant, accept that the refresh token expired and simply re-login"],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0c42157ee52f9d55af2b506d71b46249910f77d3","analyzedAt":"2026-08-20T21:50:45.477Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}