{"record":{"id":"c984517eb36bfe8e","repo":"router-for-me/CLIProxyAPI","slug":"kimi-access-denied-by-user","errorCode":null,"errorMessage":"kimi: access denied by user","messagePattern":"kimi: access denied by user","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/kimi/kimi.go","lineNumber":322,"sourceCode":"\t\tTokenType        string  `json:\"token_type\"`\n\t\tExpiresIn        float64 `json:\"expires_in\"`\n\t\tScope            string  `json:\"scope\"`\n\t}\n\n\tif err = json.Unmarshal(bodyBytes, &oauthResp); err != nil {\n\t\treturn nil, fmt.Errorf(\"kimi: failed to parse token response: %w\", err), false\n\t}\n\n\tif oauthResp.Error != \"\" {\n\t\tswitch oauthResp.Error {\n\t\tcase \"authorization_pending\":\n\t\t\treturn nil, nil, true // Continue polling\n\t\tcase \"slow_down\":\n\t\t\treturn nil, nil, true // Continue polling (with increased interval handled by caller)\n\t\tcase \"expired_token\":\n\t\t\treturn nil, fmt.Errorf(\"kimi: device code expired\"), false\n\t\tcase \"access_denied\":\n\t\t\treturn nil, fmt.Errorf(\"kimi: access denied by user\"), false\n\t\tdefault:\n\t\t\treturn nil, fmt.Errorf(\"kimi: OAuth error: %s - %s\", oauthResp.Error, oauthResp.ErrorDescription), false\n\t\t}\n\t}\n\n\tif oauthResp.AccessToken == \"\" {\n\t\treturn nil, fmt.Errorf(\"kimi: empty access token in response\"), false\n\t}\n\n\tvar expiresAt int64\n\tif oauthResp.ExpiresIn > 0 {\n\t\texpiresAt = time.Now().Unix() + int64(oauthResp.ExpiresIn)\n\t}\n\n\treturn &KimiTokenData{\n\t\tAccessToken:  oauthResp.AccessToken,\n\t\tRefreshToken: oauthResp.RefreshToken,\n\t\tTokenType:    oauthResp.TokenType,","sourceCodeStart":304,"sourceCodeEnd":340,"githubUrl":"https://github.com/router-for-me/CLIProxyAPI/blob/78f0c4079e3e6273d65d03b5549cffc898703264/internal/auth/kimi/kimi.go#L304-L340","documentation":"The token endpoint returned OAuth error 'access_denied': the user actively rejected the authorization request at the Kimi consent page (or an admin policy denies the client). This is a deliberate user action, not a malfunction.","triggerScenarios":"User clicks 'Deny'/'Cancel' on the Kimi verification page; entering the user_code on someone else's account that refuses consent; enterprise policy auto-denying the OAuth client.","commonSituations":"User changes their mind mid-login, wrong account signed into the browser when verifying, organizational OAuth allow-lists blocking the Kimi Code client.","solutions":["Ask the user whether they denied the prompt; if accidental, restart login and click Approve","Make sure the browser session used at the verification URL is logged into the intended Kimi account","If an org policy blocks the client, use a personal account or get the client allow-listed"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"func isAccessDeniedErr(err error) bool {\n    return err != nil && strings.Contains(err.Error(), \"access denied by user\")\n}","tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"access denied by user\") {\n    // prompt the user: did they mean to deny? restart flow if not\n}","preventionTips":["Verify the browser used for the verification URL is on the right Kimi account","Show users that approving, not denying, is required","Don't auto-retry denial loops — ask the user"],"tags":["kimi","oauth","device-flow","access-denied","consent"],"backgroundTag":null,"analyzedSha":"78f0c4079e3e6273d65d03b5549cffc898703264","analyzedAt":"2026-08-15T12:26:37.444Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}