{"record":{"id":"9ba06b6b599999c3","repo":"BoundaryML/baml","slug":"auth-server-returned-status-value","errorCode":null,"errorMessage":"Auth server returned {status}: {value}","messagePattern":"Auth server returned (.+?): (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"baml_language/crates/baml_cli/src/auth.rs","lineNumber":403,"sourceCode":"            .json()\n            .context(\"Failed to parse token endpoint response\")?;\n\n        if status.is_success() {\n            return serde_json::from_value(value).context(\"Failed to parse token response\");\n        }\n\n        let error = value.get(\"error\").and_then(|e| e.as_str()).unwrap_or(\"\");\n        match error {\n            \"authorization_pending\" => std::thread::sleep(interval),\n            \"slow_down\" => {\n                interval += Duration::from_secs(5);\n                std::thread::sleep(interval);\n            }\n            \"access_denied\" => anyhow::bail!(\"Login was denied in the browser.\"),\n            \"expired_token\" => anyhow::bail!(\n                \"the confirmation code expired before it was used; run `baml auth login` again\"\n            ),\n            _ => anyhow::bail!(\"Auth server returned {status}: {value}\"),\n        }\n    }\n}\n\n// ---------------------------------------------------------------------------\n// Request plumbing\n// ---------------------------------------------------------------------------\n\n/// WorkOS authenticate response. Field presence varies by grant, so\n/// everything but `access_token` is optional.\n#[derive(Debug, Deserialize)]\nstruct TokenResponse {\n    access_token: String,\n    refresh_token: Option<String>,\n    expires_in: Option<u64>,\n    user: Option<TokenUser>,\n}\n","sourceCodeStart":385,"sourceCodeEnd":421,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/baml_language/crates/baml_cli/src/auth.rs#L385-L421","documentation":"Catch-all branch of poll_token_endpoint: the token endpoint returned an unrecognized `error` value (anything besides authorization_pending, slow_down, access_denied, expired_token), so the CLI bails echoing the HTTP status and raw error payload. It signals an unexpected condition from the auth server.","triggerScenarios":"device_login -> poll_token_endpoint receiving a token response whose `error` field matches none of the known device-flow error codes.","commonSituations":"Auth server version drift introducing new error codes (e.g. invalid_client, invalid_scope, server errors surfaced as the error field); proxy/gateway injecting error pages; pointing the CLI at a custom/wrong auth endpoint.","solutions":["Read the echoed status and value to identify the server-side error.","Verify the auth endpoint/region configuration is correct and up to date.","Update the BAML CLI to a version that knows the new error code.","Retry later if the auth server is degraded (5xx status)."],"exampleFix":null,"handlingStrategy":"fallback","validationCode":null,"typeGuard":null,"tryCatchPattern":"match baml_cli::auth::device_login(...) {\n    Err(e) if e.to_string().contains(\"Auth server returned\") => {\n        // log full context; retry with backoff or report to server operator\n        eprintln!(\"{e:#}\");\n        retry_with_backoff(|| baml_cli::auth::device_login(...), 3)?;\n    }\n    r => r?,\n}","preventionTips":["Keep the BAML CLI updated for new device-flow error codes.","Verify the configured auth endpoint URL is the official one.","Check status pages / proxies when seeing 5xx statuses.","Capture the echoed status+value when filing bug reports."],"tags":["auth","oauth-device-flow","unexpected-response","cli"],"backgroundTag":"unexpected-response-shape","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}