eyaltoledano/claude-task-master · error · LoadAPIKeyError

Grok CLI authentication failed: ${result.stderr}

Error message

Grok CLI authentication failed: ${result.stderr}

What it means

When the Grok CLI subprocess exits nonzero and its stderr mentions 'unauthorized' or 'authentication', doGenerate throws a dedicated authentication error containing the CLI's stderr. This distinguishes credential rejection (expired/invalid key, wrong account) from other CLI failures, which get a generic API-call error instead.

Source

Thrown at packages/ai-sdk-provider-grok-cli/src/grok-cli-language-model.ts:310

		if (this.settings.baseURL) {
			args.push('--base-url', this.settings.baseURL);
		}

		// Add working directory if specified
		if (this.settings.workingDirectory) {
			args.push('--directory', this.settings.workingDirectory);
		}

		try {
			const result = await this.executeGrokCli(args, { apiKey });

			if (result.exitCode !== 0) {
				// Handle authentication errors
				if (
					result.stderr.toLowerCase().includes('unauthorized') ||
					result.stderr.toLowerCase().includes('authentication')
				) {
					throw createAuthenticationError({
						message: `Grok CLI authentication failed: ${result.stderr}`
					});
				}

				throw createAPICallError({
					message: `Grok CLI failed with exit code ${result.exitCode}: ${result.stderr || 'Unknown error'}`,
					exitCode: result.exitCode,
					stderr: result.stderr,
					stdout: result.stdout,
					promptExcerpt: prompt.substring(0, 200),
					isRetryable: false
				});
			}

			// Parse response
			const response = convertFromGrokCliResponse(result.stdout);
			let text = response.text || '';

View on GitHub (pinned to c0c98d367c)

Solutions

1. Verify and re-set the key: update GROK_CLI_API_KEY (or re-auth via `grok` interactive login) with a current valid key.
2. Regenerate the API key in the provider console and update your environment/secret store.
3. Inspect the stderr in the error message for the exact auth rejection reason (expired vs invalid vs permission).
4. Ensure CI secrets are synced and not stale after a key rotation.
5. Check system clock skew — badly skewed clocks can invalidate token-based auth.

Example fix

// before (shell)
export GROK_CLI_API_KEY=old-revoked-key
// after (shell)
export GROK_CLI_API_KEY=<newly-generated-key>

function isGrokAuthError(e) {
  return e instanceof Error && /Grok CLI authentication failed/.test(e.message);
}

try {
  const result = await model.doGenerate({ prompt });
} catch (e) {
  if (isGrokAuthError(e)) {
    console.error('Grok credentials rejected — re-authenticate or regenerate the API key.');
    // do NOT auto-retry; auth failures need human intervention
  } else throw e;
}

When it happens

Trigger: doGenerate spawns the Grok CLI; the process exits with code != 0 and stderr contains 'unauthorized' or 'authentication' — typically an invalid, revoked, expired, or wrong-environment API key.

Common situations: Rotated or revoked API keys still cached in grok-cli config; using a key from the wrong provider/account; corporate proxy stripping auth; typos when pasting the key; key valid locally but missing/expired in CI.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• Grok CLI API key not found. Set GROK_CLI_API_KEY environment
• Azure API key is required
• ${this.name} API key is required
• Grok CLI failed with exit code ${result.exitCode}: ${result.
• Grok CLI execution failed: ${(error as Error).message}

AI-assisted analysis of eyaltoledano/claude-task-master@c0c98d367c (2026-08-29). Data as JSON: /api/errors/89d0511dd0f7ae2d. Report an issue: GitHub.