{"record":{"id":"c90dbd347dcf5906","repo":"BoundaryML/baml","slug":"the-confirmation-code-expired-before-it-was-used-run-baml","errorCode":null,"errorMessage":"the confirmation code expired before it was used; run `baml auth login` again","messagePattern":"the confirmation code expired before it was used; run `baml auth login` again","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"baml_language/crates/baml_cli/src/auth.rs","lineNumber":400,"sourceCode":"            .context(\"Failed to reach the auth server\")?;\n        let status = resp.status();\n        let value: serde_json::Value = resp\n            .json()\n            .context(\"Failed to parse token endpoint response\")?;\n\n        if status.is_success() {\n            return serde_json::from_value(value).context(\"Failed to parse token response\");\n        }\n\n        let error = value.get(\"error\").and_then(|e| e.as_str()).unwrap_or(\"\");\n        match error {\n            \"authorization_pending\" => std::thread::sleep(interval),\n            \"slow_down\" => {\n                interval += Duration::from_secs(5);\n                std::thread::sleep(interval);\n            }\n            \"access_denied\" => anyhow::bail!(\"Login was denied in the browser.\"),\n            \"expired_token\" => anyhow::bail!(\n                \"the confirmation code expired before it was used; run `baml auth login` again\"\n            ),\n            _ => anyhow::bail!(\"Auth server returned {status}: {value}\"),\n        }\n    }\n}\n\n// ---------------------------------------------------------------------------\n// Request plumbing\n// ---------------------------------------------------------------------------\n\n/// WorkOS authenticate response. Field presence varies by grant, so\n/// everything but `access_token` is optional.\n#[derive(Debug, Deserialize)]\nstruct TokenResponse {\n    access_token: String,\n    refresh_token: Option<String>,\n    expires_in: Option<u64>,","sourceCodeStart":382,"sourceCodeEnd":418,"githubUrl":"https://github.com/BoundaryML/baml/blob/bd85ce9dee1463ff04d27efd20531013a4ff46c1/baml_language/crates/baml_cli/src/auth.rs#L382-L418","documentation":"The device-flow confirmation code expired before being used: the token endpoint returned error=\"expired_token\". Device codes have a short lifetime; once expired, the login attempt must be restarted from scratch.","triggerScenarios":"device_login -> poll_token_endpoint receiving error=\"expired_token\" from the token endpoint while polling.","commonSituations":"Waiting too long before opening the URL or entering the code; leaving the login prompt idle during a meeting/lunch; very short-lived codes on a self-hosted auth server.","solutions":["Run `baml auth login` again and complete the browser step immediately.","Copy-paste the confirmation code rather than retyping it slowly.","Check clock skew (system time) if codes seem to expire instantly."],"exampleFix":null,"handlingStrategy":"retry","validationCode":null,"typeGuard":null,"tryCatchPattern":"match baml_cli::auth::device_login(...) {\n    Err(e) if e.to_string().contains(\"confirmation code expired\") => {\n        eprintln!(\"Code expired; restarting login...\");\n        baml_cli::auth::device_login(...)?;\n    }\n    r => r?,\n}","preventionTips":["Act on the URL/code as soon as it is printed.","Paste the code instead of typing it manually.","Keep system clocks synced (NTP) to avoid premature expiry.","Increase device-code lifetime if you operate a custom auth server."],"tags":["auth","oauth-device-flow","expired-token","cli"],"backgroundTag":"jwt-token-expired","analyzedSha":"bd85ce9dee1463ff04d27efd20531013a4ff46c1","analyzedAt":"2026-09-12T03:38:25.718Z","contentChangedAt":"2026-09-12T03:38:25.718Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}