{"record":{"id":"5ee3a70fb24786aa","repo":"BoundaryML/baml","slug":"login-was-denied-in-the-browser","errorCode":null,"errorMessage":"Login was denied in the browser.","messagePattern":"Login was denied in the browser\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"baml_language/crates/baml_cli/src/auth.rs","lineNumber":399,"sourceCode":"            .send()\n            .context(\"Failed to reach the auth server\")?;\n        let status = resp.status();\n        let value: serde_json::Value = resp\n            .json()\n            .context(\"Failed to parse token endpoint response\")?;\n\n        if status.is_success() {\n            return serde_json::from_value(value).context(\"Failed to parse token response\");\n        }\n\n        let error = value.get(\"error\").and_then(|e| e.as_str()).unwrap_or(\"\");\n        match error {\n            \"authorization_pending\" => std::thread::sleep(interval),\n            \"slow_down\" => {\n                interval += Duration::from_secs(5);\n                std::thread::sleep(interval);\n            }\n            \"access_denied\" => anyhow::bail!(\"Login was denied in the browser.\"),\n            \"expired_token\" => anyhow::bail!(\n                \"the confirmation code expired before it was used; run `baml auth login` again\"\n            ),\n            _ => anyhow::bail!(\"Auth server returned {status}: {value}\"),\n        }\n    }\n}\n\n// ---------------------------------------------------------------------------\n// Request plumbing\n// ---------------------------------------------------------------------------\n\n/// WorkOS authenticate response. Field presence varies by grant, so\n/// everything but `access_token` is optional.\n#[derive(Debug, Deserialize)]\nstruct TokenResponse {\n    access_token: String,\n    refresh_token: Option<String>,","sourceCodeStart":381,"sourceCodeEnd":417,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/baml_language/crates/baml_cli/src/auth.rs#L381-L417","documentation":"The OAuth device-flow token endpoint returned error=\"access_denied\", meaning the user explicitly clicked deny/refused the login request in the browser. poll_token_endpoint converts that into a bail; the CLI cannot proceed without re-initiating login.","triggerScenarios":"device_login -> poll_token_endpoint receiving a response whose `error` field equals \"access_denied\" while polling for the token.","commonSituations":"User hit \"Cancel\"/\"Deny\" on the consent page; a shared machine's other user denied the prompt; corporate security tooling auto-denies consent screens.","solutions":["Re-run `baml auth login` and click Allow/Approve on the consent screen.","Confirm you are authenticating in a browser session under your own account.","If an org policy auto-denies consent, ask IT to allow the BAML CLI OAuth client."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"match baml_cli::auth::device_login(...) {\n    Err(e) if e.to_string().contains(\"denied in the browser\") => {\n        eprintln!(\"Login denied; re-running and please click Allow this time...\");\n        baml_cli::auth::device_login(...)?;\n    }\n    r => r?,\n}","preventionTips":["Click Allow/Approve on the OAuth consent screen.","Use your own browser profile so the prompt reaches you.","Whitelist the BAML CLI OAuth client in org security policy.","Avoid initiating login from unattended shared machines."],"tags":["auth","oauth-device-flow","consent-denied","cli"],"backgroundTag":"authentication-required","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}