chatboxai/chatbox · error · Error

MiniMax authorization failed: ${text}

Error message

MiniMax authorization failed: ${text}

What it means

Thrown by MiniMax's startDeviceFlow() when the initial POST to {baseUrl}/oauth/code returns non-2xx. The raw response body is interpolated, exposing MiniMax's reason. This is the very first call that registers the device flow and obtains the user_code, so failure here means the polling stage is never reached.

Source

Thrown at src/main/oauth/providers/minimax.ts:109

        method: 'POST',
        headers: {
          Accept: 'application/json',
          'Content-Type': 'application/x-www-form-urlencoded',
          'x-request-id': randomUUID(),
        },
        body: new URLSearchParams({
          response_type: 'code',
          client_id: MINIMAX_CLIENT_ID,
          scope: 'group_id profile model.completion',
          code_challenge: challenge,
          code_challenge_method: 'S256',
          state,
        }).toString(),
      })

      if (!response.ok) {
        const text = await response.text()
        throw new Error(`MiniMax authorization failed: ${text}`)
      }

      const payload = (await response.json()) as {
        user_code: string
        verification_uri: string
        expired_in?: number
        interval?: number
        state: string
      }

      if (payload.state !== state) {
        throw new Error('MiniMax OAuth state mismatch')
      }

      pendingUserCode = payload.user_code
      pendingVerifier = verifier
      pendingIntervalMs = toPollingIntervalMs(payload.interval)

View on GitHub (pinned to 81571269ad)

Solutions

1. Match the baseUrl to the provider variant — Global uses api.minimax.io, CN uses api.minimaxi.com.
2. Verify MINIMAX_CLIENT_ID and that the scope string matches what MiniMax registered for the client.
3. Read the interpolated body for MiniMax's status_msg; 4xx usually means client/scope mismatch, 5xx means retry.
4. Confirm code_challenge_method is 'S256' and the challenge is the base64url SHA-256 of the verifier.

Example fix

// before
const response = await fetch(`${config.baseUrl}/oauth/code`, init)
if (!response.ok) {
  const text = await response.text()
  throw new Error(`MiniMax authorization failed: ${text}`)
}

// after
if (!response.ok) {
  const text = await response.text()
  log.error('[OAuth:MiniMax] device code request failed', response.status, text)
  if (response.status >= 500) throw new TransientError('MiniMax unavailable, retry')
  throw new Error(`MiniMax authorization failed (${response.status}): ${text}`)
}

// Confirm the provider variant matches its base URL before starting.
function assertMiniMaxVariant(providerId: string, baseUrl: string) {
  if (providerId === 'minimax' && !baseUrl.includes('api.minimax.io')) throw new Error('Global MiniMax must use api.minimax.io')
  if (providerId === 'minimax-cn' && !baseUrl.includes('api.minimaxi.com')) throw new Error('CN MiniMax must use api.minimaxi.com')
}

try {
  return await provider.startDeviceFlow()
} catch (e) {
  const msg = String(e)
  if (/MiniMax authorization failed/i.test(msg)) {
  if (/5\d\d|network|fetch/i.test(msg)) return await provider.startDeviceFlow() // transient retry
  throw new Error('MiniMax rejected the device request — check client_id, scope, and baseUrl.')
  }
  throw e
}

When it happens

Trigger: Wrong baseUrl for the chosen provider variant (api.minimax.io vs api.minimaxi.com for CN); MINIMAX_CLIENT_ID rejected; requested scope (group_id profile model.completion) not permitted for the client; malformed code_challenge; request-id header rejected; MiniMax API outage or rate limit.

Common situations: User selected MiniMax CN but the global baseUrl is hit (or vice-versa); MINIMAX_CLIENT_ID constant drifted after a server-side rotation; PKCE challenge not S256-compatible; corporate firewall rewriting the form body.

Related errors

• Qwen device authorization failed: ${text}
• Token exchange failed: ${error}
• ${response.status} ${response.statusText}: ${text}
• MiniMax OAuth failed: ${errorMessage || text}
• MiniMax OAuth timed out waiting for authorization.

AI-assisted analysis of chatboxai/chatbox@81571269ad (2026-08-12). Data as JSON: /api/errors/699f6a254de21b5d. Report an issue: GitHub.