jdx/mise · error

GitHub device authorization was denied

Error message

GitHub device authorization was denied

What it means

GitHub's device-flow token endpoint returned error=access_denied: the user (or a policy) explicitly denied the authorization request at github.com/login/device. poll_access_token maps this to 'GitHub device authorization was denied' and aborts; retrying with the same code will never succeed.

Source

Thrown at src/github/oauth.rs:366

                    debug!("transient error polling GitHub OAuth token: {err:#}");
                    continue;
                }
            },
            Err(err) => {
                debug!("transient error polling GitHub OAuth token: {err:#}");
                continue;
            }
        };

        match response.error.as_deref() {
            None => return Ok(response),
            Some("authorization_pending") => continue,
            Some("slow_down") => {
                interval += 5;
                continue;
            }
            Some("expired_token") => bail!("GitHub device authorization expired"),
            Some("access_denied") => bail!("GitHub device authorization was denied"),
            Some(error) => {
                let details = response
                    .error_description
                    .unwrap_or_else(|| error.to_string());
                bail!("{details}");
            }
        }
    }
}

async fn refresh_token(cached: &CachedToken) -> Result<Option<CachedToken>> {
    let Some(refresh_token) = cached.refresh_token.as_deref() else {
        return Ok(None);
    };
    if cached
        .refresh_expires_at
        .is_some_and(|exp| exp <= chrono::Utc::now())
    {

View on GitHub (pinned to afd2eddd3a)

Solutions

  1. Rerun `mise token github --oauth` and click Authorize (not deny) when prompted.
  2. Verify your GitHub account/organization grants the requested OAuth app; ask an admin if org policy blocks it.
  3. Confirm you are logged into the intended GitHub account in the browser where you enter the code.
  4. If org policy prevents OAuth grants, use a personal access token via GITHUB_TOKEN instead.

Example fix

// before
# device page: clicked 'Cancel'
// GitHub device authorization was denied

// after
mise token github --oauth
# on github.com/login/device click 'Authorize mise'
Defensive patterns

Strategy: try-catch

Validate before calling

null

Type guard

null

Try / catch

if let Err(e) = token_async(req).await {
    if e.to_string().contains("was denied") {
        eprintln!("authorization denied; rerun and click Authorize on github.com/login/device");
    }
}

Prevention

When it happens

Trigger: poll_access_token receives a token response whose error field equals "access_denied" — the user clicked 'I authorize' as deny / canceled, or an org SSO/APP policy blocked the grant for the client_id in settings.github.oauth_client_id.

Common situations: User misclicks deny on the device page; user lacks permission for the requested scope in an enterprise/org with restrictive policies; someone else enters the code and denies it.

Understand the failure class

Background: Permission denied / not authorized / 403 Forbidden: access-control rejections when the caller lacks the required role, grant, or ownership — this error's family across 18 libraries.

Related errors

AI-assisted analysis of jdx/mise@afd2eddd3a (2026-09-09). Data as JSON: /api/errors/0abe729094c85754. Report an issue: GitHub.