{"record":{"id":"a5e8f3835d7a5324","repo":"mastra-ai/mastra","slug":"xai-device-authorization-returned-an-invalid-verif","errorCode":null,"errorMessage":"xAI device authorization returned an invalid verification_uri: ${raw}","messagePattern":"xAI device authorization returned an invalid verification_uri: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"mastracode/sdk/src/auth/providers/xai.ts","lineNumber":42,"sourceCode":"// Refresh 5 minutes before actual expiry (same skew as Anthropic).\nconst REFRESH_SKEW_MS = 5 * 60 * 1000;\n\nasync function postForm(url: string, params: Record<string, string>, signal?: AbortSignal): Promise<Response> {\n  return fetch(url, {\n    method: 'POST',\n    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },\n    body: new URLSearchParams(params).toString(),\n    signal,\n  });\n}\n\n/** The verification URI is opened by the user; only accept https URLs. */\nfunction validateVerificationUri(raw: string): string {\n  let parsed: URL;\n  try {\n    parsed = new URL(raw);\n  } catch {\n    throw new Error(`xAI device authorization returned an invalid verification_uri: ${raw}`);\n  }\n  if (parsed.protocol !== 'https:') {\n    throw new Error(`xAI device authorization returned a non-https verification_uri: ${raw}`);\n  }\n  return parsed.toString();\n}\n\nfunction credentialsFromTokenResponse(data: unknown, previousRefreshToken?: string): OAuthCredentials {\n  const record = (data ?? {}) as Record<string, unknown>;\n  const access = record.access_token;\n  if (typeof access !== 'string' || access.length === 0) {\n    throw new Error('xAI token response missing access_token');\n  }\n\n  // xAI may not rotate the refresh token on refresh; keep the previous one.\n  const refresh =\n    typeof record.refresh_token === 'string' && record.refresh_token.length > 0\n      ? record.refresh_token","sourceCodeStart":24,"sourceCodeEnd":60,"githubUrl":"https://github.com/mastra-ai/mastra/blob/75dd419e613fe9c39f846ffc500716141b74fda6/mastracode/sdk/src/auth/providers/xai.ts#L24-L60","documentation":"validateVerificationUri parses the verification_uri returned by the xAI device-authorization endpoint; if the value cannot be parsed as a URL at all, this error is thrown. The URI is what the user opens in a browser, so a malformed value means the provider response is unusable or hostile.","triggerScenarios":"startXAIDeviceLogin receives a device-authorization response whose verification_uri (or verification_uri_complete) is not a valid URL string (e.g. empty, relative path, HTML error page fragment).","commonSituations":"xAI API contract change or regression; a proxy/captive portal intercepting the request and returning non-JSON/garbage that still passes the field check; pointing DEVICE_CODE_URL at a mock or wrong endpoint during local development.","solutions":["Log the raw device-authorization response body to see what verification_uri actually contained.","Ensure the device-code endpoint URL is the official xAI endpoint (no overridden base URL/proxy).","Retry the device login; if persistent, report a provider-side contract change and upgrade the SDK.","If behind a corporate proxy, bypass it for the xAI API hosts."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"function isParseableUrl(raw: unknown): raw is string {\n  if (typeof raw !== 'string' || raw.length === 0) return false;\n  try { new URL(raw); return true; } catch { return false; }\n}","tryCatchPattern":"try {\n  const pending = await startXAIDeviceLogin();\n} catch (e) {\n  if (e instanceof Error && e.message.includes('invalid verification_uri')) {\n    // log raw response for provider debugging, then retry\n    console.error('xAI returned unusable verification_uri; retrying device login');\n  }\n}","preventionTips":["Do not override or proxy the xAI device-code endpoint URL","Pin/monitor the SDK version against xAI API contract changes","Log raw device-authorization responses to diagnose provider regressions","Exclude xAI API hosts from corporate interception proxies"],"tags":["oauth","xai","device-flow","validation"],"backgroundTag":"invalid-verification-uri","analyzedSha":"75dd419e613fe9c39f846ffc500716141b74fda6","analyzedAt":"2026-08-30T00:15:31.844Z","schemaVersion":2},"datasetVersion":"2026-08-30T08:17:16.595Z"}