decolua/9router · warning · Error

"Too many pending authorization requests. Please try again l

Error message

"Too many pending authorization requests. Please try again later."

What it means

Kilocode's requestDeviceCode POSTs to config.initiateUrl to start a device authorization session. When the Kilocode API answers HTTP 429 (rate limited / too many outstanding pending device authorizations for the account or IP), this specific message is thrown instead of the generic 'Device auth initiation failed'. It is a server-side throttle, not a bug in the caller's parameters.

Source

Thrown at src/lib/oauth/providers/kilocode.js:13

import { KILOCODE_CONFIG } from "../constants/oauth.js";

const kilocode = {
  config: KILOCODE_CONFIG,
  flowType: "device_code",
  requestDeviceCode: async (config) => {
    const response = await fetch(config.initiateUrl, {
      method: "POST",
      headers: { "Content-Type": "application/json" },
    });
    if (!response.ok) {
      if (response.status === 429) {
        throw new Error("Too many pending authorization requests. Please try again later.");
      }
      const error = await response.text();
      throw new Error(`Device auth initiation failed: ${error}`);
    }
    const data = await response.json();
    return {
      device_code: data.code,
      user_code: data.code,
      verification_uri: data.verificationUrl,
      verification_uri_complete: data.verificationUrl,
      expires_in: data.expiresIn || 300,
      interval: 3,
    };
  },
  pollToken: async (config, deviceCode) => {
    const response = await fetch(`${config.pollUrlBase}/${deviceCode}`);
    if (response.status === 202) return { ok: false, data: { error: "authorization_pending" } };
    if (response.status === 403) return { ok: false, data: { error: "access_denied", error_description: "Authorization denied by user" } };

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Wait (typically minutes) for existing pending device authorizations to expire, then retry once
2. Stop automatic retry loops on this error — back off exponentially and cap attempts instead of retrying immediately
3. Reuse the currently pending session: if a verification URL was already issued, have the user complete that one rather than initiating a new session
4. Contact Kilocode support if the limit persists with no outstanding requests (shared-IP throttling)

Example fix

// before
for (;;) { await requestDeviceCode('kilocode', challenge); } // hammers API, guarantees 429
// after
try {
  const dc = await requestDeviceCode('kilocode', challenge);
} catch (e) {
  if (/Too many pending authorization/.test(e.message)) {
    await sleep(60000); // back off before a single retry
  } else throw e;
}

// No client-side check can predict the server-side 429; instead cap concurrency and
// reuse existing pending sessions before initiating:
let pendingKilocodeSession = null;
async function initiateOnce() {
  if (pendingKilocodeSession && Date.now() < pendingKilocodeSession.expiresAt) return pendingKilocodeSession;
  const dc = await requestDeviceCode('kilocode', challenge);
  pendingKilocodeSession = { ...dc, expiresAt: Date.now() + (dc.expires_in || 300) * 1000 };
  return pendingKilocodeSession;
}

const delays = [5000, 15000, 60000];
for (let i = 0; i < delays.length; i++) {
  try { return await requestDeviceCode('kilocode', challenge); }
  catch (e) {
    if (!/Too many pending authorization/.test(e.message)) throw e;
    await new Promise(r => setTimeout(r, delays[i])); // bounded backoff, then give up
  }
}
throw new Error('Kilocode device auth still rate-limited; try again later');

When it happens

Trigger: Calling the Kilocode device-auth initiation (via requestDeviceCode('kilocode', ...) or the dashboard 'Connect Kilocode' flow) while the account/IP already has too many unexpired pending authorization requests, or after repeatedly retrying initiation in a short window.

Common situations: Automated retry loops hammering the initiate endpoint after failed polls; shared IP (CI, office NAT) hitting the limit from multiple users; abandoned device sessions accumulating until they expire.

Related errors

• HTTP ${response.status}: ${errorMsg}
• `Provider ${providerName} does not support device code flow`
• `Device auth initiation failed: ${error}`
• `Device code request failed: ${error}`
• `Client registration failed: ${error}`

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/88484f88e18e8611. Report an issue: GitHub.