langchain-ai/deepagents · error · RuntimeError

Token request failed: HTTP

Error message

Token request failed: HTTP {token_response.status_code} from {token_url}.

What it means

`_run_device_flow` raises this RuntimeError when the HTTP request to exchange the device code for an OAuth token returns a non-2xx status that is not part of the expected polling protocol. The raw status code and token URL are surfaced to make the failing endpoint identifiable.

Solutions

1. Check the HTTP status in the message — 4xx from a proxy usually means network/proxy misconfiguration, not an auth problem
2. Retry the login; transient 5xx/429 responses from GitHub often resolve on retry
3. Verify any base-URL override or HTTPS_PROXY/HTTP_PROXY env vars point at a working endpoint that forwards to github.com
4. If persistent, check GitHub status (githubstatus.com) for an ongoing incident

Example fix

// before: restrictive proxy blocking the token endpoint
export HTTPS_PROXY=http://proxy.corp:8080  # blocks github.com/login/oauth
// after
export NO_PROXY=github.com  # or allowlist github.com on the proxy

# Pre-check connectivity to the token host before login
import httpx
try:
    httpx.head("https://github.com", timeout=10).raise_for_status()
except httpx.HTTPStatusError as exc:
    print(f"github.com unreachable via current proxy: {exc}")

try:
    login(server_name)
except RuntimeError as exc:
    if "Token request failed: HTTP" in str(exc):
        status = int(str(exc).split("HTTP ")[1].split()[0])
        if status in (429, 500, 502, 503, 504):
            time.sleep(5)
            login(server_name)  # transient — retry
    raise

When it happens

Trigger: The POST to the GitHub token URL returns an unexpected HTTP status (e.g. 403 rate-limit response, 500 server error, or a proxy 407) instead of 200-with-error-field or the tolerated 400 pending responses handled earlier in the loop.

Common situations: Corporate proxy intercepts github.com traffic; GitHub API rate limiting; transient GitHub outage; a firewall or SSL-terminating middlebox rewrites the response; misconfigured GITHUB_API_URL-like base URL override pointing at a non-GitHub server.

Related errors

• Device code request failed: HTTP
• Device flow failed
• Device flow timed out. Try logging in again.
• Token response from is not a valid OAuth token payload
• Authorization denied by provider

AI-assisted analysis of langchain-ai/deepagents@a1af029e6e (2026-08-29). Data as JSON: /api/errors/743f808ecc2097c6. Report an issue: GitHub.

Appendix: source

Thrown at libs/code/deepagents_code/mcp_auth.py:1971

                )
                body = {}
            err = body.get("error")
            if err == "authorization_pending":
                continue
            if err == "slow_down":
                interval += 5
                continue
            if err:
                msg = f"Device flow failed: {err}: {body.get('error_description', '')}"
                raise RuntimeError(msg)
            try:
                token_response.raise_for_status()
            except httpx.HTTPStatusError as exc:
                msg = (
                    f"Token request failed: HTTP {token_response.status_code} "
                    f"from {token_url}."
                )
                raise RuntimeError(msg) from exc
            try:
                return OAuthToken.model_validate(body)
            except ValidationError as exc:
                msg = (
                    f"Token response from {token_url} is not a valid "
                    f"OAuth token payload: {exc}"
                )
                raise RuntimeError(msg) from exc

    msg = "Device flow timed out. Try logging in again."
    raise RuntimeError(msg)


def format_login_failure(exc: BaseException) -> str:
    """Return a token-safe single-line summary of an OAuth-login exception.

    OAuth handshakes commonly surface as `ExceptionGroup` (anyio task
    groups) or as MCP-SDK errors whose `args`/`repr` may include an

View on GitHub (pinned to a1af029e6e)