{"record":{"id":"e9315095cdc99066","repo":"xai-org/grok-build","slug":"devbox-mints-an-xai-credential-which-this-build","errorCode":null,"errorMessage":"--devbox mints an xAI credential, which this build cannot use","messagePattern":"--devbox mints an xAI credential, which this build cannot use","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-shell/src/auth/flow.rs","lineNumber":854,"sourceCode":"            .await\n            .map(Some)\n    }\n}\n/// Unified `grok login` handler for CLI entry points (tui, pager).\n///\n/// Precedence: `--oauth` forces loopback, `--device-auth` forces device,\n/// otherwise `GROK_LOGIN_DEVICE_FLOW` env / `[auth] login_device_flow` config /\n/// loopback default. Both transports run through `run_auth_flow_inner` so the\n/// external auth provider and devbox auto-migration are tried first.\npub async fn run_cli_login(\n    config: &crate::agent::config::Config,\n    oauth: bool,\n    device_auth: bool,\n    devbox: bool,\n) -> anyhow::Result<()> {\n    if devbox {\n        if !ActiveAuthBackend::default().is_xai_authority() {\n            anyhow::bail!(\"--devbox mints an xAI credential, which this build cannot use\");\n        }\n        let auth = super::devbox_login::run_devbox_login(config).await?;\n        return apply_post_login_config(auth).await;\n    }\n    let auth_manager = Arc::new(AuthManager::new(\n        &grok_home::grok_home(),\n        config.grok_com_config.clone(),\n    ));\n    crate::agent::init::update_telemetry_config(config, &auth_manager);\n    let result = run_cli_login_steps(config, &auth_manager, oauth, device_auth).await;\n    xai_grok_telemetry::session_ctx::drain_pending(xai_grok_telemetry::session_ctx::CLI_DRAIN)\n        .await;\n    result\n}\nasync fn run_cli_login_steps(\n    config: &crate::agent::config::Config,\n    auth_manager: &Arc<AuthManager>,\n    oauth: bool,","sourceCodeStart":836,"sourceCodeEnd":872,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-shell/src/auth/flow.rs#L836-L872","documentation":"run_cli_login rejects the --devbox flag when the active auth backend is not an xAI authority, because devbox login mints an xAI-specific credential that the current build cannot consume. The check fails fast before running the devbox flow.","triggerScenarios":"run_cli_login invoked with devbox=true while ActiveAuthBackend::default().is_xai_authorization() returns false — i.e. the build is configured against a non-xAI authority (e.g. enterprise OIDC or a third-party IdP).","commonSituations":"Running --devbox in an enterprise build where the default backend is the company IdP; using a forked/rebranded build where the xAI authority is disabled; CI images configured for enterprise SSO.","solutions":["Drop the --devbox flag and authenticate with the backend this build supports (grok login or XAI_API_KEY).","Use a build configured against the xAI authority if you specifically need devbox credentials.","If you believe the backend is wrong, check the build's authority/backend configuration before login.","For enterprise deployments, request credentials through your administrator's SSO flow instead."],"exampleFix":"// before\ngrok login --devbox   # non-xAI backend build\n// after\ngrok login            # or: export XAI_API_KEY=...","handlingStrategy":"validation","validationCode":"// only pass --devbox when the backend is xAI-authority\nif devbox && !ActiveAuthBackend::default().is_xai_authority() {\n    eprintln!(\"--devbox unsupported in this build; use `grok login` or XAI_API_KEY.\");\n    return;\n}","typeGuard":null,"tryCatchPattern":"match run_cli_login(&config, oauth, device_auth, devbox).await {\n    Err(e) if e.to_string().contains(\"--devbox mints an xAI credential\") => {\n        eprintln!(\"This build can't use devbox credentials; authenticating without --devbox.\");\n        run_cli_login(&config, oauth, device_auth, false).await?;\n    }\n    other => other?,\n}","preventionTips":["Document that --devbox requires an xAI-authority build.","Hide or disable the --devbox flag in enterprise/forked builds.","Choose the login method based on ActiveAuthBackend at startup.","In CI, avoid devbox and rely on XAI_API_KEY."],"tags":["cli","authentication","flag-misuse"],"backgroundTag":"unsupported-auth-backend","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}