{"record":{"id":"8cdc489fb516a11b","repo":"BerriAI/litellm","slug":"xai-oauth-state-mismatch","errorCode":null,"errorMessage":"xAI OAuth state mismatch","messagePattern":"xAI OAuth state mismatch","errorType":"exception","errorClass":"XAIOAuthError","httpStatus":null,"severity":"error","filePath":"litellm/llms/xai/oauth.py","lineNumber":148,"sourceCode":"        verifier, challenge = self._pkce_pair()\n        state: Final = uuid.uuid4().hex\n        nonce: Final = uuid.uuid4().hex\n        server, redirect_uri = self._start_callback_server(state)\n        authorize_url: Final = self._build_authorize_url(\n            authorization_endpoint=discovery[\"authorization_endpoint\"],\n            redirect_uri=redirect_uri,\n            challenge=challenge,\n            state=state,\n            nonce=nonce,\n        )\n\n        if no_browser or not webbrowser.open(authorize_url):\n            sys.stdout.write(f\"Open this URL to authenticate with xAI:\\n{authorize_url}\\n\")\n            sys.stdout.flush()\n\n        result: Final = self._wait_for_callback(server)\n        if result.get(\"state\") != state:\n            raise XAIOAuthError(\"xAI OAuth state mismatch\")\n        if result.get(\"error\"):\n            description: Final = result.get(\"error_description\") or result[\"error\"]\n            raise XAIOAuthError(f\"xAI authorization failed: {description}\")\n        code: Final = result.get(\"code\")\n        if not code:\n            raise XAIOAuthError(\"xAI authorization failed: no code returned\")\n\n        token_payload: Final = self._exchange_token(\n            discovery[\"token_endpoint\"],\n            {\n                \"grant_type\": \"authorization_code\",\n                \"code\": code,\n                \"redirect_uri\": redirect_uri,\n                \"client_id\": XAI_OAUTH_CLIENT_ID,\n                \"code_verifier\": verifier,\n            },\n        )\n        auth_data: Final = self._build_auth_record(token_payload, discovery[\"token_endpoint\"])","sourceCodeStart":130,"sourceCodeEnd":166,"githubUrl":"https://github.com/BerriAI/litellm/blob/77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8/litellm/llms/xai/oauth.py#L130-L166","documentation":"XAIOAuthError raised when the OAuth callback's returned state does not equal the state issued in the authorization URL — a classic CSRF/interception signal in the PKCE flow, so the callback result is rejected outright.","triggerScenarios":"Thrown at litellm/llms/xai/oauth.py:148 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Restart the OAuth login flow; a state mismatch means the callback does not match the original request (possible stale or tampered flow).","Ensure you complete the login in the same session that started it and do not reuse old authorization URLs."],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"77b7c6c40c0c5aa5fbcb1d6a1825ac39ca8829b8","analyzedAt":"2026-08-18T11:44:31.656Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}