{"record":{"id":"bb88d0e4effc3179","repo":"xai-org/grok-build","slug":"sign-in-is-not-available-for-this-deployment-set","errorCode":null,"errorMessage":"Sign-in is not available for this deployment. Set XAI_API_KEY instead.","messagePattern":"Sign-in is not available for this deployment\\. Set XAI_API_KEY instead\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-shell/src/auth/flow.rs","lineNumber":878,"sourceCode":"        &grok_home::grok_home(),\n        config.grok_com_config.clone(),\n    ));\n    crate::agent::init::update_telemetry_config(config, &auth_manager);\n    let result = run_cli_login_steps(config, &auth_manager, oauth, device_auth).await;\n    xai_grok_telemetry::session_ctx::drain_pending(xai_grok_telemetry::session_ctx::CLI_DRAIN)\n        .await;\n    result\n}\nasync fn run_cli_login_steps(\n    config: &crate::agent::config::Config,\n    auth_manager: &Arc<AuthManager>,\n    oauth: bool,\n    device_auth: bool,\n) -> anyhow::Result<()> {\n    let login_override = LoginTransportOverride::from_flags(oauth, device_auth);\n    let authenticated = if cli_should_use_device(&config.grok_com_config, login_override).await {\n        if config.grok_com_config.oauth2.is_none() {\n            anyhow::bail!(\"Sign-in is not available for this deployment. Set XAI_API_KEY instead.\");\n        }\n        let (auth, did_auth) = run_auth_flow_interactive(\n            auth_manager,\n            &config.grok_com_config,\n            None,\n            None,\n            None,\n            LoginTransportOverride::Preresolved(true),\n        )\n        .await?;\n        if did_auth {\n            report_signed_in(&auth);\n        }\n        auth\n    } else {\n        if device_auth && crate::auth::oidc::is_configured(&config.grok_com_config) {\n            eprintln!(\n                \"Device-code login isn't available for your SSO provider; using browser sign-in.\"","sourceCodeStart":860,"sourceCodeEnd":896,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-shell/src/auth/flow.rs#L860-L896","documentation":"run_cli_login_steps determined that the device-code flow should be used (per cli_should_device and the --device-auth override), but config.grok_com_config.oauth2 is None, meaning no OAuth2 client configuration exists to drive the device flow. The deployment therefore cannot perform interactive sign-in and the user is told to use a static API key.","triggerScenarios":"run_cli_login_steps runs with device_auth=true (or device flow auto-selected) and config.grok_com_config.oauth2.is_none() — raised from run_cli_login when device login is requested in a deployment without OAuth2 config.","commonSituations":"Fresh install without `grok login` having ever provisioned oauth2 config; enterprise/headless environment where only XAI_API_KEY is supported; config file missing the oauth2 section after an upgrade or migration.","solutions":["Set the XAI_API_KEY environment variable and skip interactive device login.","Run `grok login` once (browser flow) to provision the OAuth2 configuration, then retry `--device-auth`.","Check that your config file contains a grok_com.oauth2 section and that GROK_HOME points to it.","In enterprise deployments, confirm with your administrator whether device sign-in is supported at all."],"exampleFix":"// before\ngrok login --device-auth   # no oauth2 config present\n// after\nexport XAI_API_KEY=xai-...\n# or provision config first:\ngrok login","handlingStrategy":"validation","validationCode":"// decide login mode up front\nif want_device_login && config.grok_com_config.oauth2.is_none() {\n    if let Ok(key) = std::env::var(\"XAI_API_KEY\") {\n        eprintln!(\"OAuth2 unavailable; using XAI_API_KEY.\");\n    } else {\n        eprintln!(\"Run `grok login` first to provision OAuth2 config.\");\n        return;\n    }\n}","typeGuard":null,"tryCatchPattern":"match run_cli_login(&config, oauth, device_auth, false).await {\n    Err(e) if e.to_string().contains(\"Sign-in is not available for this deployment\") => {\n        eprintln!(\"Set XAI_API_KEY or run `grok login` to provision OAuth2 config.\");\n    }\n    other => other?,\n}","preventionTips":["Provision OAuth2 config via `grok login` before offering --device-auth in scripts.","Fall back to XAI_API_KEY automatically when oauth2 config is absent.","Validate config completeness (grok_com.oauth2 section) at CLI startup.","In headless deployments, standardize on API keys instead of device flow."],"tags":["oauth","device-flow","configuration"],"backgroundTag":"missing-oauth-configuration","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}