{"record":{"id":"ffff1c12a7b96abc","repo":"cube-js/cube","slug":"authorization-failed-other","errorCode":null,"errorMessage":"authorization failed: {other}{}","messagePattern":"authorization failed: (.+?)(.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"rust/cube-cli/src/oauth.rs","lineNumber":167,"sourceCode":"\n        if status.is_success() {\n            return serde_json::from_str(&text)\n                .map_err(|e| api_error(format!(\"could not parse token response: {e}\\n{text}\")));\n        }\n\n        // RFC 8628 §3.5: pending/slow_down keep polling; anything else is fatal.\n        match serde_json::from_str::<TokenError>(&text) {\n            Ok(err) => match err.error.as_str() {\n                \"authorization_pending\" => continue,\n                \"slow_down\" => {\n                    interval += 5;\n                    continue;\n                }\n                \"access_denied\" => bail!(\"authorization was denied in the browser\"),\n                \"expired_token\" => {\n                    bail!(\"device code expired before it was authorized; run `cube login` again\")\n                }\n                other => bail!(\n                    \"authorization failed: {other}{}\",\n                    err.error_description\n                        .map(|d| format!(\" ({d})\"))\n                        .unwrap_or_default()\n                ),\n            },\n            Err(_) => api_bail!(\n                \"token poll failed ({status}) at {endpoint}: {}\",\n                text.trim()\n            ),\n        }\n    }\n}\n\n/// Exchange a refresh token for a new access/refresh token pair\n/// (OAuth 2.0 refresh_token grant). Used transparently by the API client\n/// when an access token has expired.\npub async fn refresh(","sourceCodeStart":149,"sourceCodeEnd":185,"githubUrl":"https://github.com/cube-js/cube/blob/7d981676b36392fec34088b9afab6bdcad40207c/rust/cube-cli/src/oauth.rs#L149-L185","documentation":"Catch-all for any token-endpoint error code the device-flow polling loop does not specifically recognize. Per RFC 8628 §3.5 only `authorization_pending` and `slow_down` are transient; `access_denied` and `expired_token` get dedicated messages, and every other `error` value is fatal. The server's optional `error_description` is appended for context.","triggerScenarios":"Raised in poll_for_token when the token endpoint returns a TokenError whose `error` string matches none of authorization_pending/slow_down/access_denied/expired_token — e.g. `invalid_grant`, `invalid_client`, `unauthorized_client`, or `invalid_request`.","commonSituations":"Misconfigured OAuth client_id/client_secret in the CLI's OAuthConfig; the provider revoked or disabled the client; provider returns a non-standard error code; server-side policy rejects the device grant entirely.","solutions":["Read the appended error_description and the raw error code for the server's exact reason","Verify the OAuth client_id/client_secret configured for the CLI match a valid client on the auth server","Confirm the auth server supports the device authorization grant (urn:ietf:params:oauth:grant-type:device_code)","Run `cube login` again after fixing configuration; if it persists, check the provider's status or CLI version vs. API changes"],"exampleFix":"// before: stale/mismatched client credentials\nclient_id: \"old-client\"\n\n// after: update CLI config / re-authenticate\ncube login  // with a client_id registered for device flow","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"match err.to_string() {\n    m if m.starts_with(\"authorization failed: \") => {\n        let code = m.trim_start_matches(\"authorization failed: \");\n        // inspect code/description, fix OAuth client config, retry login\n    }\n    _ => {}\n}","preventionTips":["Keep client_id/client_secret in the CLI's OAuth config valid and current","Confirm the identity provider enables the device authorization grant","Keep the CLI updated so it understands the provider's current error codes","Read the appended error_description before retrying blindly"],"tags":["oauth","device-code-flow","cli","authentication","protocol-violation"],"backgroundTag":"oauth-unknown-error-code","analyzedSha":"7d981676b36392fec34088b9afab6bdcad40207c","analyzedAt":"2026-09-02T03:45:10.400Z","contentChangedAt":null,"schemaVersion":2},"datasetVersion":"2026-09-08T15:18:49.778Z"}