{"record":{"id":"ee2baaa2ede1f6e6","repo":"xai-org/grok-build","slug":"no-oauth2-configuration-available-run-grok-login","errorCode":null,"errorMessage":"No OAuth2 configuration available. Run `grok login` to authenticate, or contact your administrator if you use enterprise SSO.","messagePattern":"No OAuth2 configuration available\\. Run `grok login` to authenticate, or contact your administrator if you use enterprise SSO\\.","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"crates/codegen/xai-grok-shell/src/auth/flow.rs","lineNumber":640,"sourceCode":"                {\n                    tracing::warn!(\n                        \"auth: device flow unavailable (404), falling back to loopback login\"\n                    );\n                }\n                other => return other,\n            }\n        }\n        return crate::auth::oidc::run_login_flow_with_config(\n            &oauth2_cfg.as_oidc(),\n            auth_manager,\n            channels,\n        )\n        .await;\n    }\n    tracing::error!(\n        \"auth: no OAuth2 configuration available (neither enterprise OIDC nor xAI OAuth2 configured)\"\n    );\n    anyhow::bail!(\n        \"No OAuth2 configuration available. Run `grok login` to authenticate, or contact your administrator if you use enterprise SSO.\"\n    )\n}\n/// Non-interactive auth refresh: returns valid credentials if available without\n/// ever triggering interactive login (browser, device code, etc.).\n///\n/// Tries in order:\n/// 1. Cached credentials (non-expired)\n/// 2. OIDC silent refresh (if expired token has a refresh_token)\n/// 3. External auth provider command (if configured)\n///\n/// Returns `None` when no valid credentials can be obtained non-interactively.\npub async fn try_ensure_fresh_auth(grok_com_config: &GrokComConfig) -> Option<GrokAuth> {\n    try_ensure_fresh_auth_with(&build_startup_auth_manager(grok_com_config)).await\n}\n/// Builds and configures the startup `AuthManager`; the policy helpers below\n/// take it injected so tests can substitute their own.\nfn build_startup_auth_manager(grok_com_config: &GrokComConfig) -> Arc<AuthManager> {","sourceCodeStart":622,"sourceCodeEnd":658,"githubUrl":"https://github.com/xai-org/grok-build/blob/bc7f02eddd3d84085849dc19ed216f11c23b0571/crates/codegen/xai-grok-shell/src/auth/flow.rs#L622-L658","documentation":"run_auth_flow_steps exhausted all authentication options: neither an enterprise OIDC configuration nor an xAI OAuth2 configuration is present in the config. Without any OAuth2 setup, no interactive sign-in flow can run, so the client bails with guidance to authenticate or contact an administrator.","triggerScenarios":"run_auth_flow_steps reaches the end after enterprise OIDC and xAI OAuth2 branches were both unavailable — i.e. config.grok_com_config.oauth2 is None and no enterprise SSO config exists, while an auth flow was requested (e.g. device-auth path in run_cli_login_steps with oauth2.is_none()).","commonSituations":"Fresh install with no `grok login` ever run and no config file; XAI_API_KEY absent in a build that requires OAuth2; enterprise deployment where the admin never provisioned OIDC settings; config file corrupted or pointing at the wrong grok_home.","solutions":["Run `grok login` to perform interactive authentication and populate the OAuth2 config.","Set the XAI_API_KEY environment variable if you authenticate via API key rather than OAuth2.","For enterprise SSO, ask your administrator to deploy the OIDC configuration.","Verify GROK_HOME / config path points to the file that actually contains oauth2 settings."],"exampleFix":"// before: no credentials\n$ grok login --device-auth\n// after: configure auth first\nexport XAI_API_KEY=xai-...\n# or\ngrok login","handlingStrategy":"validation","validationCode":"// before invoking any login flow, check config availability\nif config.grok_com_config.oauth2.is_none() && std::env::var_os(\"XAI_API_KEY\").is_none() {\n    eprintln!(\"No OAuth2 config and no XAI_API_KEY; run `grok login` first.\");\n}","typeGuard":null,"tryCatchPattern":"match run_auth_flow(&auth_manager, &config).await {\n    Err(e) if e.to_string().contains(\"No OAuth2 configuration available\") => {\n        eprintln!(\"Run `grok login` or export XAI_API_KEY before retrying.\");\n    }\n    other => other?,\n}","preventionTips":["Run `grok login` once after install to provision the OAuth2 config.","Keep XAI_API_KEY set in CI/containers where interactive login is impossible.","Verify GROK_HOME points at the config file that actually holds oauth2 settings.","For enterprise SSO, confirm OIDC settings are deployed before distributing the CLI."],"tags":["oauth","configuration","authentication"],"backgroundTag":"missing-oauth-configuration","analyzedSha":"bc7f02eddd3d84085849dc19ed216f11c23b0571","analyzedAt":"2026-08-31T04:59:42.031Z","schemaVersion":2},"datasetVersion":"2026-08-31T09:17:48.483Z"}