langchain-ai/deepagents · error · RuntimeError

Token request failed: HTTP {token_response.status_code} from

Error message

Token request failed: HTTP {token_response.status_code} from {token_url}.

What it means

`_run_device_flow` raises this RuntimeError when the HTTP request to exchange the device code for an OAuth token returns a non-2xx status that is not part of the expected polling protocol. The raw status code and token URL are surfaced to make the failing endpoint identifiable.

Source

Thrown at libs/code/deepagents_code/mcp_auth.py:1971

                )
                body = {}
            err = body.get("error")
            if err == "authorization_pending":
                continue
            if err == "slow_down":
                interval += 5
                continue
            if err:
                msg = f"Device flow failed: {err}: {body.get('error_description', '')}"
                raise RuntimeError(msg)
            try:
                token_response.raise_for_status()
            except httpx.HTTPStatusError as exc:
                msg = (
                    f"Token request failed: HTTP {token_response.status_code} "
                    f"from {token_url}."
                )
                raise RuntimeError(msg) from exc
            try:
                return OAuthToken.model_validate(body)
            except ValidationError as exc:
                msg = (
                    f"Token response from {token_url} is not a valid "
                    f"OAuth token payload: {exc}"
                )
                raise RuntimeError(msg) from exc

    msg = "Device flow timed out. Try logging in again."
    raise RuntimeError(msg)


def format_login_failure(exc: BaseException) -> str:
    """Return a token-safe single-line summary of an OAuth-login exception.

    OAuth handshakes commonly surface as `ExceptionGroup` (anyio task
    groups) or as MCP-SDK errors whose `args`/`repr` may include an

View on GitHub (pinned to a1af029e6e)

Solutions

  1. Check the HTTP status in the message — 4xx from a proxy usually means network/proxy misconfiguration, not an auth problem
  2. Retry the login; transient 5xx/429 responses from GitHub often resolve on retry
  3. Verify any base-URL override or HTTPS_PROXY/HTTP_PROXY env vars point at a working endpoint that forwards to github.com
  4. If persistent, check GitHub status (githubstatus.com) for an ongoing incident

Example fix

// before: restrictive proxy blocking the token endpoint
export HTTPS_PROXY=http://proxy.corp:8080  # blocks github.com/login/oauth
// after
export NO_PROXY=github.com  # or allowlist github.com on the proxy
Defensive patterns

Strategy: retry

Validate before calling

# Pre-check connectivity to the token host before login
import httpx
try:
    httpx.head("https://github.com", timeout=10).raise_for_status()
except httpx.HTTPStatusError as exc:
    print(f"github.com unreachable via current proxy: {exc}")

Try / catch

try:
    login(server_name)
except RuntimeError as exc:
    if "Token request failed: HTTP" in str(exc):
        status = int(str(exc).split("HTTP ")[1].split()[0])
        if status in (429, 500, 502, 503, 504):
            time.sleep(5)
            login(server_name)  # transient — retry
    raise

Prevention

When it happens

Trigger: The POST to the GitHub token URL returns an unexpected HTTP status (e.g. 403 rate-limit response, 500 server error, or a proxy 407) instead of 200-with-error-field or the tolerated 400 pending responses handled earlier in the loop.

Common situations: Corporate proxy intercepts github.com traffic; GitHub API rate limiting; transient GitHub outage; a firewall or SSL-terminating middlebox rewrites the response; misconfigured GITHUB_API_URL-like base URL override pointing at a non-GitHub server.

Related errors

AI-assisted analysis of langchain-ai/deepagents@a1af029e6e (2026-08-29). Data as JSON: /api/errors/743f808ecc2097c6. Report an issue: GitHub.