{"record":{"id":"51d2c7a88c688d11","repo":"BoundaryML/baml","slug":"auth-server-returned-status-body","errorCode":null,"errorMessage":"Auth server returned {status}: {body}","messagePattern":"Auth server returned (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"baml_language/crates/baml_cli/src/auth.rs","lineNumber":444,"sourceCode":"}\n\n/// POSTs a form-encoded body and deserializes a successful JSON response.\n///\n/// Errors:\n/// - On network failure, a non-success status (the response body is\n///   included in the error), or a body that fails to deserialize as `T`.\nfn post_form<T: serde::de::DeserializeOwned>(url: &str, form: &[(&str, &str)]) -> Result<T> {\n    let client = http_client();\n    let resp = client\n        .post(url)\n        .header(\"content-type\", \"application/x-www-form-urlencoded\")\n        .body(encode_form(form))\n        .send()\n        .context(\"Failed to reach the auth server\")?;\n    let status = resp.status();\n    if !status.is_success() {\n        let body = resp.text().unwrap_or_default();\n        anyhow::bail!(\"Auth server returned {status}: {body}\");\n    }\n    resp.json().context(\"Failed to parse auth server response\")\n}\n\nfn encode_form(form: &[(&str, &str)]) -> String {\n    form.iter()\n        .map(|(k, v)| format!(\"{k}={}\", form_urlencode(v)))\n        .collect::<Vec<_>>()\n        .join(\"&\")\n}\n\n/// Percent-encodes a form value.\n///\n/// RFC 3986 unreserved characters pass through; every other byte is\n/// `%XX`-encoded.\nfn form_urlencode(s: &str) -> String {\n    let mut out = String::with_capacity(s.len());\n    for byte in s.bytes() {","sourceCodeStart":426,"sourceCodeEnd":462,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/baml_language/crates/baml_cli/src/auth.rs#L426-L462","documentation":"post_form received a non-success HTTP status from the auth server and bails with the status and the raw response body. This is a generic failure of any form POST to the token endpoint (used by device_login and access_token refresh), surfaced before JSON parsing is attempted.","triggerScenarios":"POSTing the encoded form (device code grant or refresh token grant) to the token endpoint and receiving status.is_success() == false; the body is read with resp.text().unwrap_or_default().","commonSituations":"Expired/revoked refresh token on `baml` commands after long absence; auth server outage or 502/503 from a proxy; wrong base URL configured; firewall blocking egress.","solutions":["Read the included status/body for the server's specific reason.","If the refresh token is invalid/expired, run `baml auth login` again.","Check the auth server status / corporate proxy settings.","Verify the configured auth endpoint URL."],"exampleFix":"// before: assume 200 always\nlet tokens: TokenResponse = post_form(...)?;\n// after: handle non-2xx explicitly\nlet resp = client.post(endpoint).form(&form).send()?;\nif !resp.status().is_success() {\n    eprintln!(\"auth failed ({}): {}\", resp.status(), resp.text()?);\n    return Err(anyhow!(\"re-authenticate with `baml auth login`\"));\n}","handlingStrategy":"try-catch","validationCode":"// lightweight reachability probe before auth calls\nlet ok = std::net::TcpStream::connect((\"auth.example.com\", 443)).is_ok();","typeGuard":null,"tryCatchPattern":"match result {\n    Err(e) if e.to_string().contains(\"Auth server returned\") => {\n        let status = extract_status(&e);\n        if status == 401 || status == 400 {\n            // re-authenticate\n            baml_cli::auth::login()?;\n        } else {\n            // 5xx / network: retry with backoff\n            retry_with_backoff(op, 3)?;\n        }\n    }\n    r => r?,\n}","preventionTips":["Re-login when refresh tokens are old or possibly revoked.","Check auth-server health and proxy/VPN settings before batch operations.","Verify the auth base URL in configuration.","Treat 4xx as re-auth and 5xx as retry in wrappers."],"tags":["auth","http","network","cli"],"backgroundTag":"http-error-response","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}