can1357/oh-my-pi · warning · AIError.OAuthError

Too many pending authorization requests. Please try again la

Error message

Too many pending authorization requests. Please try again later.

What it means

Kilo's device-authorization login first POSTs to initiate a device code. When the server responds with HTTP 429 (rate limited / too many in-flight authorization requests), loginKilo throws this OAuthError with kind "polling" and the status attached. It signals the provider is refusing new device-auth sessions temporarily, not that your input is wrong.

Source

Thrown at packages/ai/src/registry/kilo.ts:29

	verificationUrl?: string;
	expiresIn?: number;
}

interface KiloDeviceAuthPollResponse {
	status?: string;
	token?: string;
}

export async function loginKilo(callbacks: OAuthController): Promise<OAuthCredentials> {
	const fetchImpl = callbacks.fetch ?? fetch;
	const initiateResponse = await fetchImpl(`${KILO_DEVICE_AUTH_BASE_URL}/codes`, {
		method: "POST",
		headers: { "Content-Type": "application/json" },
	});

	if (!initiateResponse.ok) {
		if (initiateResponse.status === 429) {
			throw new AIError.OAuthError("Too many pending authorization requests. Please try again later.", {
				kind: "polling",
				provider: "kilo",
				status: initiateResponse.status,
			});
		}
		throw new AIError.OAuthError(`Failed to initiate device authorization: ${initiateResponse.status}`, {
			kind: "device-auth",
			provider: "kilo",
			status: initiateResponse.status,
		});
	}

	const initiateData = (await initiateResponse.json()) as KiloDeviceAuthCodeResponse;
	const userCode = initiateData.code;
	const verificationUrl = initiateData.verificationUrl;
	const expiresInSeconds = initiateData.expiresIn;
	if (!userCode || !verificationUrl || typeof expiresInSeconds !== "number" || expiresInSeconds <= 0) {
		throw new AIError.OAuthError("Kilo device authorization response missing required fields", {

View on GitHub (pinned to 9690622007)

Solutions

1. Wait several minutes before retrying so pending authorization requests expire server-side.
2. Stop any loops/scripts that repeatedly call login on Kilo and retry once with backoff.
3. Reuse an existing valid session/token instead of initiating a new device flow.
4. If it persists, contact Kilo support or check service status — the pending-code quota may need clearing server-side.

Example fix

// before
for (let i = 0; i < 10; i++) await loginKilo(callbacks); // hammers initiation endpoint -> 429
// after
const { promise, resolve } = Promise.withResolvers();
await Bun.sleep(5000);
await loginKilo(callbacks); // single attempt after backoff

// throttle device-logins client-side to stay under the pending-code quota
let lastKiloLogin = 0;
async function loginKiloThrottled(cb: OAuthCallbacks) {
  const since = Date.now() - lastKiloLogin;
  if (since < 60_000) await Bun.sleep(60_000 - since);
  lastKiloLogin = Date.now();
  return loginKilo(cb);
}

try {
  await loginKilo(callbacks);
} catch (err) {
  if (err instanceof AIError.OAuthError && err.message.includes("Too many pending")) {
    await Bun.sleep(120_000);
    return loginKilo(callbacks); // retry after backoff
  }
  throw err;
}

When it happens

Trigger: Calling loginKilo (device flow initiation) when the Kilo authorization server returns status 429 for the initiation POST — i.e. the account/IP has too many pending device authorization codes.

Common situations: Repeated login attempts in a short window; automated scripts retrying login in a loop; shared IP (CI farm, corporate NAT) exhausting the provider's pending-code quota; abandoned device codes never expiring client-side.

Related errors

• Failed to initiate device authorization: ${initiateResponse.
• Kilo device authorization response missing required fields
• Login cancelled
• Authorization was denied
• Kimi device authorization denied

AI-assisted analysis of can1357/oh-my-pi@9690622007 (2026-08-31). Data as JSON: /api/errors/c2a8e6838324f3f0. Report an issue: GitHub.