decolua/9router · error · Error

Missing xAI authorization code

Error message

Missing xAI authorization code

What it means

completeXaiManualCode requires the authorization code returned by the xAI login page. After verifying the state/session it checks that a non-empty code string was supplied; if not it throws before attempting the token exchange. The code is required to swap for access/refresh tokens.

Source

Thrown at src/app/api/oauth/[provider]/[action]/route.js:45

  stopWindsurfProxy,
  registerWindsurfSession,
  getWindsurfSessionStatus,
  clearWindsurfSession,
  startZedProxy,
  stopZedProxy,
  registerZedSession,
  getZedSessionStatus,
  clearZedSession,
} from "@/lib/oauth/utils/server";
import { detectIdeInstalled } from "@/lib/oauth/utils/ideDetect";
import { ZED_HOSTED_CONFIG } from "@/lib/oauth/constants/oauth";

async function completeXaiManualCode(code, state) {
  const session = state ? getXaiSessionStatus(state) : null;
  if (!session) {
    throw new Error("xAI OAuth session not found; restart the login flow and paste the code again");
  }
  if (!code) throw new Error("Missing xAI authorization code");

  try {
    const tokenData = await exchangeTokens(
      "xai",
      code,
      session.redirectUri,
      session.codeVerifier,
      state
    );
    const connection = await createProviderConnection({
      provider: "xai",
      authType: "oauth",
      ...tokenData,
      expiresAt: tokenData.expiresIn
        ? new Date(Date.now() + tokenData.expiresIn * 1000).toISOString()
        : null,
      testStatus: "active",
    });

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Copy the full code=<...> query parameter from the xAI redirect URL and pass it as code.
2. Re-do the login flow if the redirect URL was lost — codes are single-use.
3. Verify the request sends code as a query param or body field, not null/undefined.

Example fix

// before
const res = await fetch(`/api/oauth/xai/callback?state=${state}`);
// after
const res = await fetch(`/api/oauth/xai/callback?code=${encodeURIComponent(code)}&state=${state}`);

const params = new URL(redirectUrl).searchParams;
const code = params.get("code");
if (!code) throw new Error("Redirect URL has no ?code= parameter");

const hasCode = (c) => typeof c === "string" && c.trim().length > 0;

try {
  await submitXaiCode(code, state);
} catch (e) {
  if (e.message === "Missing xAI authorization code") {
    console.error("Extract code= from the full redirect URL and resend");
  } else throw e;
}

When it happens

Trigger: Submitting the xAI manual-code callback (/api/oauth/xai/<action>) with code missing, empty string, or whitespace-only while the state/session lookup succeeded.

Common situations: User pastes only the state or the redirect URL without extracting the code query param; a copy-paste truncated the code; a script automation sent the request without parsing ?code= from the redirect.

Related errors

• xai discovery ${field} is empty
• xai discovery ${field} is invalid: ${err.message}
• Missing Zed callback URL
• Invalid Zed callback URL
• Zed callback must include user_id and access_token

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/7778227e559da5df. Report an issue: GitHub.