decolua/9router · error · Error

xAI OAuth session not found; restart the login flow and past

Error message

xAI OAuth session not found; restart the login flow and paste the code again

What it means

completeXaiManualCode is the manual-code branch of the xAI OAuth callback: it looks up the pending login session by the state parameter. If state is missing or no session exists for that state, the exchange cannot proceed (no redirect_uri / verifier), so this error is thrown and the user must restart the login flow.

Source

Thrown at src/app/api/oauth/[provider]/[action]/route.js:43

  clearTraeSession,
  startWindsurfProxy,
  stopWindsurfProxy,
  registerWindsurfSession,
  getWindsurfSessionStatus,
  clearWindsurfSession,
  startZedProxy,
  stopZedProxy,
  registerZedSession,
  getZedSessionStatus,
  clearZedSession,
} from "@/lib/oauth/utils/server";
import { detectIdeInstalled } from "@/lib/oauth/utils/ideDetect";
import { ZED_HOSTED_CONFIG } from "@/lib/oauth/constants/oauth";

async function completeXaiManualCode(code, state) {
  const session = state ? getXaiSessionStatus(state) : null;
  if (!session) {
    throw new Error("xAI OAuth session not found; restart the login flow and paste the code again");
  }
  if (!code) throw new Error("Missing xAI authorization code");

  try {
    const tokenData = await exchangeTokens(
      "xai",
      code,
      session.redirectUri,
      session.codeVerifier,
      state
    );
    const connection = await createProviderConnection({
      provider: "xai",
      authType: "oauth",
      ...tokenData,
      expiresAt: tokenData.expiresIn
        ? new Date(Date.now() + tokenData.expiresIn * 1000).toISOString()
        : null,

View on GitHub (pinned to 90b52e06ff)

Solutions

1. Restart the xAI OAuth login flow from the dashboard and paste a fresh authorization code with its new state value.
2. Do not reuse a state/code pair that was already submitted.
3. If the server was restarted, redo the whole flow — sessions are not persisted across restarts.

Example fix

// before
fetch("/api/oauth/xai/callback?code=NEW_CODE&state=OLD_STATE")
// after
fetch("/api/oauth/xai/callback?code=NEW_CODE&state=STATE_FROM_NEW_LOGIN")

const session = state ? getXaiSessionStatus(state) : null;
if (!session) {
  throw new Error("No active xAI session for this state — restart login first");
}

const hasActiveXaiSession = (state) =>
  typeof state === "string" && state.length > 0 && getXaiSessionStatus(state) != null;

try {
  await completeXaiLogin(code, state);
} catch (e) {
  if (e.message.includes("session not found")) {
    startNewXaiLoginFlow(); // regenerate state + session
  } else throw e;
}

When it happens

Trigger: Calling /api/oauth/xai/<action> with a code but an empty, expired, or already-consumed state; restarting the server between starting login and pasting the code; pasting the code twice; or tampering with the state query param.

Common situations: Dev restarts the gateway mid-login (in-memory session store lost), user takes too long so the session expired, or the same manual code flow is retried after the first attempt already consumed the session.

Related errors

• Missing xAI authorization code
• xai discovery ${field} is empty
• xai discovery ${field} is invalid: ${err.message}
• `xai discovery ${field} must use https: ${value}`
• `xai discovery ${field} host ${host} is not on x.ai`

AI-assisted analysis of decolua/9router@90b52e06ff (2026-08-30). Data as JSON: /api/errors/ecc191dd2ff4efc9. Report an issue: GitHub.