{"record":{"id":"89d0511dd0f7ae2d","repo":"eyaltoledano/claude-task-master","slug":"grok-cli-authentication-failed-result-stderr","errorCode":null,"errorMessage":"Grok CLI authentication failed: ${result.stderr}","messagePattern":"Grok CLI authentication failed: (.+?)","errorType":"exception","errorClass":"LoadAPIKeyError","httpStatus":null,"severity":"error","filePath":"packages/ai-sdk-provider-grok-cli/src/grok-cli-language-model.ts","lineNumber":310,"sourceCode":"\t\tif (this.settings.baseURL) {\n\t\t\targs.push('--base-url', this.settings.baseURL);\n\t\t}\n\n\t\t// Add working directory if specified\n\t\tif (this.settings.workingDirectory) {\n\t\t\targs.push('--directory', this.settings.workingDirectory);\n\t\t}\n\n\t\ttry {\n\t\t\tconst result = await this.executeGrokCli(args, { apiKey });\n\n\t\t\tif (result.exitCode !== 0) {\n\t\t\t\t// Handle authentication errors\n\t\t\t\tif (\n\t\t\t\t\tresult.stderr.toLowerCase().includes('unauthorized') ||\n\t\t\t\t\tresult.stderr.toLowerCase().includes('authentication')\n\t\t\t\t) {\n\t\t\t\t\tthrow createAuthenticationError({\n\t\t\t\t\t\tmessage: `Grok CLI authentication failed: ${result.stderr}`\n\t\t\t\t\t});\n\t\t\t\t}\n\n\t\t\t\tthrow createAPICallError({\n\t\t\t\t\tmessage: `Grok CLI failed with exit code ${result.exitCode}: ${result.stderr || 'Unknown error'}`,\n\t\t\t\t\texitCode: result.exitCode,\n\t\t\t\t\tstderr: result.stderr,\n\t\t\t\t\tstdout: result.stdout,\n\t\t\t\t\tpromptExcerpt: prompt.substring(0, 200),\n\t\t\t\t\tisRetryable: false\n\t\t\t\t});\n\t\t\t}\n\n\t\t\t// Parse response\n\t\t\tconst response = convertFromGrokCliResponse(result.stdout);\n\t\t\tlet text = response.text || '';\n","sourceCodeStart":292,"sourceCodeEnd":328,"githubUrl":"https://github.com/eyaltoledano/claude-task-master/blob/c0c98d367c55296bfe69e65680625b6db437af02/packages/ai-sdk-provider-grok-cli/src/grok-cli-language-model.ts#L292-L328","documentation":"When the Grok CLI subprocess exits nonzero and its stderr mentions 'unauthorized' or 'authentication', doGenerate throws a dedicated authentication error containing the CLI's stderr. This distinguishes credential rejection (expired/invalid key, wrong account) from other CLI failures, which get a generic API-call error instead.","triggerScenarios":"doGenerate spawns the Grok CLI; the process exits with code != 0 and stderr contains 'unauthorized' or 'authentication' — typically an invalid, revoked, expired, or wrong-environment API key.","commonSituations":"Rotated or revoked API keys still cached in grok-cli config; using a key from the wrong provider/account; corporate proxy stripping auth; typos when pasting the key; key valid locally but missing/expired in CI.","solutions":["Verify and re-set the key: update GROK_CLI_API_KEY (or re-auth via `grok` interactive login) with a current valid key.","Regenerate the API key in the provider console and update your environment/secret store.","Inspect the stderr in the error message for the exact auth rejection reason (expired vs invalid vs permission).","Ensure CI secrets are synced and not stale after a key rotation.","Check system clock skew — badly skewed clocks can invalidate token-based auth."],"exampleFix":"// before (shell)\nexport GROK_CLI_API_KEY=old-revoked-key\n// after (shell)\nexport GROK_CLI_API_KEY=<newly-generated-key>","handlingStrategy":"try-catch","validationCode":null,"typeGuard":"function isGrokAuthError(e) {\n  return e instanceof Error && /Grok CLI authentication failed/.test(e.message);\n}","tryCatchPattern":"try {\n  const result = await model.doGenerate({ prompt });\n} catch (e) {\n  if (isGrokAuthError(e)) {\n    console.error('Grok credentials rejected — re-authenticate or regenerate the API key.');\n    // do NOT auto-retry; auth failures need human intervention\n  } else throw e;\n}","preventionTips":["Rotate and sync API keys through a secret manager so all environments get updates.","Do not auto-retry authentication errors; fail fast and prompt for re-auth.","Verify keys interactively with the `grok` CLI before deploying automation.","Watch for key expiry/revocation notices and update environments proactively."],"tags":["grok-cli","authentication","api-key","subprocess"],"backgroundTag":"authentication-failed","analyzedSha":"c0c98d367c55296bfe69e65680625b6db437af02","analyzedAt":"2026-08-29T02:56:26.071Z","schemaVersion":2},"datasetVersion":"2026-08-29T07:17:48.351Z"}