earendil-works/pi · error · Error

Untrusted verification URI in xAI OAuth response

Error message

Untrusted verification URI in xAI OAuth response

What it means

Error "Untrusted verification URI in xAI OAuth response" thrown in earendil-works/pi.

Source

Thrown at packages/ai/src/auth/oauth/xai.ts:56

	return value;
}

function positiveNumber(body: JsonObject, field: string): number {
	const value = body[field];
	if (typeof value !== "number" || !Number.isFinite(value) || value <= 0) {
		throw new Error(`Invalid xAI OAuth response field: ${field}`);
	}
	return value;
}

// The verification URI is opened in the user's browser; force it to be an https URL
// so a malicious response cannot make `open` launch something else.
function validateVerificationUri(raw: string): string {
	let url: URL;
	try {
		url = new URL(raw);
	} catch {
		throw new Error("Untrusted verification URI in xAI OAuth response");
	}
	if (url.protocol !== "https:") {
		throw new Error("Untrusted verification URI in xAI OAuth response");
	}
	return url.href;
}

async function postForm(url: string, fields: Record<string, string>, signal: AbortSignal): Promise<OAuthHttpResponse> {
	let response: Response;
	try {
		response = await fetch(url, {
			method: "POST",
			headers: {
				Accept: "application/json",
				"Content-Type": "application/x-www-form-urlencoded",
			},
			body: new URLSearchParams(fields),
			signal,

View on GitHub (pinned to 4af9d21d3b)

Solutions

1. Abort the login; the verification URI is untrusted, so check for a MITM or misconfigured proxy.

When it happens

Trigger: Thrown at packages/ai/src/auth/oauth/xai.ts:56 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of earendil-works/pi@4af9d21d3b (2026-08-24). Data as JSON: /api/errors/cef70fe639438b4d. Report an issue: GitHub.