{"record":{"id":"73f668454edb2a2b","repo":"cube-js/cube","slug":"authorization-was-denied-in-the-browser","errorCode":null,"errorMessage":"authorization was denied in the browser","messagePattern":"authorization was denied in the browser","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"rust/cube-cli/src/oauth.rs","lineNumber":163,"sourceCode":"            Err(_) => continue,\n        };\n        let status = res.status();\n        let text = res.text().await.unwrap_or_default();\n\n        if status.is_success() {\n            return serde_json::from_str(&text)\n                .map_err(|e| api_error(format!(\"could not parse token response: {e}\\n{text}\")));\n        }\n\n        // RFC 8628 §3.5: pending/slow_down keep polling; anything else is fatal.\n        match serde_json::from_str::<TokenError>(&text) {\n            Ok(err) => match err.error.as_str() {\n                \"authorization_pending\" => continue,\n                \"slow_down\" => {\n                    interval += 5;\n                    continue;\n                }\n                \"access_denied\" => bail!(\"authorization was denied in the browser\"),\n                \"expired_token\" => {\n                    bail!(\"device code expired before it was authorized; run `cube login` again\")\n                }\n                other => bail!(\n                    \"authorization failed: {other}{}\",\n                    err.error_description\n                        .map(|d| format!(\" ({d})\"))\n                        .unwrap_or_default()\n                ),\n            },\n            Err(_) => api_bail!(\n                \"token poll failed ({status}) at {endpoint}: {}\",\n                text.trim()\n            ),\n        }\n    }\n}\n","sourceCodeStart":145,"sourceCodeEnd":181,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/rust/cube-cli/src/oauth.rs#L145-L181","documentation":"During the device-code login flow, the CLI polls the token endpoint per RFC 8628 §3.5. When the authorization server responds with error code `access_denied`, it means the user actively rejected the authorization request in the browser (clicked deny/cancel). The CLI treats this as a terminal outcome and aborts with this message.","triggerScenarios":"Raised in poll_for_token when the token endpoint returns a TokenError whose `error` field equals \"access_denied\" — i.e. the user (or an admin policy) denied the device authorization consent prompt.","commonSituations":"User clicked 'Deny' or 'Cancel' on the consent screen; user pasted the wrong device code into someone else's session; SSO/IDP policy auto-denies the request (e.g. device flow disabled, conditional access rules).","solutions":["Run `cube login` again and click Allow/Approve on the consent screen","Verify you are signed into the correct Cube Cloud account in the browser before approving","If the deny was not user-initiated, check your identity provider / org policies for rules blocking device authorization grants"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// match on the bail message / error chain\nif err.to_string().contains(\"authorization was denied in the browser\") {\n    // prompt user to re-run `cube login` and click Allow\n}","preventionTips":["Click Allow/Approve on the consent screen","Sign into the correct account in the browser before authorizing","Verify your identity provider does not auto-deny device authorization grants"],"tags":["oauth","device-code-flow","access-denied","cli","authentication"],"backgroundTag":"oauth-access-denied","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}