jackwener/OpenCLI · error · AuthRequiredError

grok.com

Error message

grok.com

What it means

verifyGrokIdentity() (the grok site's auth 'whoami'/verify step) throws AuthRequiredError('grok.com', 'Grok __Secure-next-auth.session-token cookie missing') when the browser session's cookies for https://grok.com contain no non-empty __Secure-next-auth.session-token. That NextAuth session cookie is the library's quick, local check that the user is logged in to grok.com; without it every grok command would be anonymous. The error tells the user to perform the interactive site login flow before using grok commands.

Source

Thrown at clis/grok/auth.js:11

import { AuthRequiredError, CommandExecutionError } from '@jackwener/opencli/errors';
import { registerSiteAuthCommands } from '../_shared/site-auth.js';

async function hasGrokSessionCookie(page) {
  const cookies = await page.getCookies({ url: 'https://grok.com' });
  return cookies.some(c => c.name === '__Secure-next-auth.session-token' && c.value);
}

async function verifyGrokIdentity(page) {
  if (!await hasGrokSessionCookie(page)) {
    throw new AuthRequiredError('grok.com', 'Grok __Secure-next-auth.session-token cookie missing');
  }
  await page.goto('https://grok.com/');
  await page.wait(2);
  const result = await page.evaluate(`(async () => {
    try {
      const res = await fetch('/api/auth/session', { credentials: 'include', headers: { 'Accept': 'application/json' } });
      if (res.status === 401 || res.status === 403) {
        return { kind: 'auth', detail: 'Grok /api/auth/session HTTP ' + res.status };
      }
      if (!res.ok) return { kind: 'http', httpStatus: res.status };
      const d = await res.json();
      const user = d && d.user;
      if (!user || !user.id) {
        return { kind: 'auth', detail: 'Grok /api/auth/session has no user — anonymous' };
      }
      return { ok: true, user_id: String(user.id), name: String(user.name || '') };
    } catch (e) {
      return { kind: 'exception', detail: String(e && e.message || e) };

View on GitHub (pinned to 49907e53dc)

Solutions

  1. Run the grok site login flow (loginUrl https://grok.com/auth/sign-in, e.g. the registered `grok login` command) and complete sign-in interactively in the managed browser.
  2. After logging in, re-run the auth verify/whoami command to confirm __Secure-next-auth.session-token is present and /api/auth/session returns a user.
  3. If you log in manually, use the same persistent browser profile the CLI uses so the cookie lands in the right store.
  4. Check you are not in an incognito/profile-wiping setup that discards __Secure- cookies between runs.

Example fix

// before: verify against a session that was never logged in
const identity = await grokWhoami(); // AuthRequiredError
// after: run the login flow first
await grokLogin(); // opens https://grok.com/auth/sign-in and polls until session cookie exists
const identity = await grokWhoami();
Defensive patterns

Strategy: validation

Validate before calling

// Before invoking grok commands, check the session cookie in the persistent profile.
const cookies = await page.getCookies({ url: 'https://grok.com' });
const hasSession = cookies.some(c => c.name === '__Secure-next-auth.session-token' && c.value);
if (!hasSession) {
  await run('grok', 'login'); // interactive sign-in before any grok command
}

Try / catch

try {
  const who = await run('grok', 'whoami');
} catch (e) {
  if (e instanceof AuthRequiredError) {
    await run('grok', 'login');
    return await run('grok', 'whoami');
  }
  throw e;
}

Prevention

When it happens

Trigger: Calling any grok auth verify/whoami flow (or registerSiteAuthCommands login/poll path) when: (1) the persistent browser session was never logged in to grok.com; (2) the session cookie expired or was cleared (browser profile reset, cookie purge, logout elsewhere); (3) get_cookies for url https://grok.com returns cookies but none named '__Secure-next-auth.session-token' (e.g. only anonymous/CF cookies); (4) the cookie exists but with an empty value, which the hasGrokSessionCookie check rejects.

Common situations: Fresh environment/container where the persistent profile has no grok.com login; cookies expired after days/weeks since last login; running from a different machine or browser profile than the one used to log in; corporate cookie cleaners or incognito sessions wiping __Secure- cookies; grok.com logout invalidating the stored session.

Related errors

AI-assisted analysis of jackwener/OpenCLI@49907e53dc (2026-08-29). Data as JSON: /api/errors/375cddb576c6d53b. Report an issue: GitHub.