{"record":{"id":"fb3ce7a457e23a13","repo":"router-for-me/CLIProxyAPI","slug":"xai-device-authorization-denied","errorCode":null,"errorMessage":"xai device authorization denied","messagePattern":"xai device authorization denied","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"internal/auth/xai/xai.go","lineNumber":309,"sourceCode":"\t\tIDToken          string `json:\"id_token\"`\n\t\tTokenType        string `json:\"token_type\"`\n\t\tExpiresIn        int    `json:\"expires_in\"`\n\t}\n\tif err = json.Unmarshal(body, &payload); err != nil {\n\t\treturn nil, fmt.Errorf(\"xai device token: parse response: %w\", err), interval, false\n\t}\n\n\tif payload.Error != \"\" {\n\t\tswitch payload.Error {\n\t\tcase \"authorization_pending\":\n\t\t\treturn nil, nil, interval, true\n\t\tcase \"slow_down\":\n\t\t\tnextInterval := interval + defaultPollInterval\n\t\t\treturn nil, nil, nextInterval, true\n\t\tcase \"expired_token\":\n\t\t\treturn nil, fmt.Errorf(\"xai device code expired\"), interval, false\n\t\tcase \"access_denied\":\n\t\t\treturn nil, fmt.Errorf(\"xai device authorization denied\"), interval, false\n\t\tdefault:\n\t\t\tdesc := strings.TrimSpace(payload.ErrorDescription)\n\t\t\tif desc != \"\" {\n\t\t\t\treturn nil, fmt.Errorf(\"xai device token error: %s: %s\", payload.Error, desc), interval, false\n\t\t\t}\n\t\t\treturn nil, fmt.Errorf(\"xai device token error: %s\", payload.Error), interval, false\n\t\t}\n\t}\n\n\tif resp.StatusCode != http.StatusOK {\n\t\treturn nil, fmt.Errorf(\"xai device token request failed with status %d: %s\", resp.StatusCode, strings.TrimSpace(string(body))), interval, false\n\t}\n\tif strings.TrimSpace(payload.AccessToken) == \"\" {\n\t\treturn nil, fmt.Errorf(\"xai device token response missing access_token\"), interval, false\n\t}\n\n\temail, subject := parseJWTIdentity(payload.IDToken)\n\treturn buildTokenData(payload.AccessToken, payload.RefreshToken, payload.IDToken, payload.TokenType, payload.ExpiresIn, email, subject), nil, interval, false","sourceCodeStart":291,"sourceCodeEnd":327,"githubUrl":"https://github.com/router-for-me/CLIProxyAPI/blob/78f0c4079e3e6273d65d03b5549cffc898703264/internal/auth/xai/xai.go#L291-L327","documentation":"The token endpoint returned error=access_denied. The user (or an admin policy) explicitly rejected the device authorization request at the verification page, so no tokens will ever be issued for this code.","triggerScenarios":"User clicks 'Deny'/'Cancel' on the xAI consent page, or an org policy auto-denies the device flow for the client_id.","commonSituations":"User mistook the prompt for phishing and denied it; organization SSO policy blocks device authorization for third-party clients; wrong account signed in.","solutions":["Restart the flow and have the user explicitly approve the consent prompt","Verify the user signs in with an account permitted to use the xAI integration","If an org policy is blocking it, use a different authorization method or request an exemption"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil {\n    if strings.Contains(err.Error(), \"authorization denied\") {\n        // user or policy rejected: do not retry automatically; ask user to re-run login\n        return fmt.Errorf(\"xAI authorization was denied by the user or policy: %w\", err)\n    }\n    return err\n}","preventionTips":["Tell users to expect the consent prompt and click approve","Do not auto-retry access_denied; it requires explicit user action"],"tags":["oauth","device-flow","xai","access-denied"],"backgroundTag":null,"analyzedSha":"78f0c4079e3e6273d65d03b5549cffc898703264","analyzedAt":"2026-08-15T12:26:37.444Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}