{"record":{"id":"f29f31a49a9aeecb","repo":"router-for-me/CLIProxyAPI","slug":"xai-device-code-response-missing-verification-uri","errorCode":null,"errorMessage":"xai device code: response missing verification URI","messagePattern":"xai device code: response missing verification URI","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/xai/xai.go","lineNumber":172,"sourceCode":"\tif err != nil {\n\t\treturn nil, fmt.Errorf(\"xai device code: read response: %w\", err)\n\t}\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"xai device code request failed with status %d: %s\", resp.StatusCode, strings.TrimSpace(string(body)))\n\t}\n\n\tvar deviceCode DeviceCodeResponse\n\tif err = json.Unmarshal(body, &deviceCode); err != nil {\n\t\treturn nil, fmt.Errorf(\"xai device code: parse response: %w\", err)\n\t}\n\tif strings.TrimSpace(deviceCode.DeviceCode) == \"\" {\n\t\treturn nil, fmt.Errorf(\"xai device code: response missing device_code\")\n\t}\n\tif strings.TrimSpace(deviceCode.UserCode) == \"\" {\n\t\treturn nil, fmt.Errorf(\"xai device code: response missing user_code\")\n\t}\n\tif strings.TrimSpace(deviceCode.VerificationURI) == \"\" && strings.TrimSpace(deviceCode.VerificationURIComplete) == \"\" {\n\t\treturn nil, fmt.Errorf(\"xai device code: response missing verification URI\")\n\t}\n\tdeviceCode.TokenEndpoint = strings.TrimSpace(tokenEndpoint)\n\treturn &deviceCode, nil\n}\n\n// WaitForAuthorization polls until the user authorizes the device code and returns tokens.\nfunc (a *XAIAuth) WaitForAuthorization(ctx context.Context, deviceCode *DeviceCodeResponse) (*AuthBundle, error) {\n\ttokenData, err := a.PollForToken(ctx, deviceCode)\n\tif err != nil {\n\t\treturn nil, err\n\t}\n\ttokenEndpoint := \"\"\n\tif deviceCode != nil {\n\t\ttokenEndpoint = strings.TrimSpace(deviceCode.TokenEndpoint)\n\t}\n\treturn &AuthBundle{\n\t\tTokenData:     *tokenData,\n\t\tLastRefresh:   time.Now().UTC().Format(time.RFC3339),","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/router-for-me/CLIProxyAPI/blob/78f0c4079e3e6273d65d03b5549cffc898703264/internal/auth/xai/xai.go#L154-L190","documentation":"Neither verification_uri nor verification_uri_complete was present in the device authorization response. The user needs one of these URIs to enter their user_code and approve the request; the guard fires only when both are empty because either one is sufficient for the flow.","triggerScenarios":"200 JSON from the xAI device authorization endpoint where both verification_uri and verification_uri_complete are missing/whitespace, while device_code/user_code checks already passed.","commonSituations":"xAI response schema change; API gateway or HTML error page returned with 200; testing against a mock server that only implements part of the device-authorization contract.","solutions":["Capture and inspect the raw response body to confirm which fields the server actually sent","Validate the mock/staging server implements verification_uri (or verification_uri_complete) if developing against one","Re-run discovery (a.Discover) and confirm endpoints are current xAI endpoints, not cached stale URLs"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"deviceCode, err := auth.RequestDeviceCode(ctx)\nif err != nil && strings.Contains(err.Error(), \"missing verification URI\") {\n    log.Warnf(\"cannot direct user to consent page: %v\", err)\n    return err\n}","preventionTips":["Ensure the endpoint you call implements full RFC 8628 device authorization responses","Verify at least one verification URI before printing instructions to the user"],"tags":["oauth","device-flow","xai","auth","response-validation"],"backgroundTag":null,"analyzedSha":"78f0c4079e3e6273d65d03b5549cffc898703264","analyzedAt":"2026-08-15T12:26:37.444Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}