decolua/9router · error

xai discovery ${field} must use https: ${value}

Error message

xai discovery ${field} must use https: ${value}

What it means

validateOAuthEndpoint enforces that every xAI discovery endpoint uses the https: protocol; http:// values are rejected to prevent token/authorization leakage over plaintext. The offending value is included in the message.

Source

Thrown at src/lib/oauth/services/xai.js:38

 */

const BASE64_BLOCK_SIZE = 4;

let cachedDiscovery = null;

export function validateOAuthEndpoint(rawUrl, field) {
  const value = String(rawUrl || "").trim();
  if (!value) throw new Error(`xai discovery ${field} is empty`);

  let parsed;
  try {
    parsed = new URL(value);
  } catch (err) {
    throw new Error(`xai discovery ${field} is invalid: ${err.message}`);
  }

  if (parsed.protocol !== "https:") {
    throw new Error(`xai discovery ${field} must use https: ${value}`);
  }

  const host = parsed.hostname.toLowerCase().trim();
  if (host !== "x.ai" && !host.endsWith(".x.ai")) {
    throw new Error(`xai discovery ${field} host ${host} is not on x.ai`);
  }

  return value;
}

/**
 * Discover authorization + token endpoints. Cached process-wide.
 */
export async function discoverEndpoints() {
  if (cachedDiscovery) return cachedDiscovery;

  try {
    const res = await fetch(XAI_CONFIG.discoveryUrl, {

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Change the endpoint URL scheme to https://.
2. If you need local testing, put the mock behind a locally trusted TLS proxy (e.g. mkcert) — http is not accepted by design.
3. Verify the discovery document you consumed actually came from x.ai, since a non-https endpoint there indicates tampering.

Example fix

// before
XAI_AUTH_URL=http://x.ai/oauth/authorize
// after
XAI_AUTH_URL=https://x.ai/oauth/authorize

if (!/^https:\/\//i.test(cfg.authorizationUrl)) {
  throw new Error('xAI endpoints must use https://');
}

function isHttpsUrl(u) {
  try { return new URL(String(u).trim()).protocol === 'https:'; } catch { return false; }
}

When it happens

Trigger: A discovery field or manual override points at http://x.ai/... — e.g. local development URLs, reverse proxies terminating TLS upstream, or an insecure entry in a spoofed/mis-scoped discovery document.

Common situations: Developers pointing endpoints at a local http mock during testing; self-hosted proxies exposing xAI endpoints over http on an internal network.

Related errors

• xai discovery ${field} host ${host} is not on x.ai
• token_endpoint must use https
• `xai discovery ${field} must use https: ${value}`
• `xai discovery ${field} host ${host} is not on x.ai`
• xai discovery ${field} is invalid: ${err.message}

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/27f0840b2b8484a1. Report an issue: GitHub.