Failed to initiate xAI device authorization: ${response.stat

Error message

Failed to initiate xAI device authorization: ${response.status}${text ? ` ${text}` : ''}

What it means

startXAIDeviceLogin POSTs the client_id and scope to the xAI device-authorization endpoint. If the HTTP response is not ok, it reads the body (best-effort) and throws with the status code and any text, surfacing why device authorization could not begin.

Source

Thrown at mastracode/sdk/src/auth/providers/xai.ts:106

  /** RFC 8628 poll-loop state (interval growth, deadline, slow_down count). */
  state: DeviceCodePollState;
}

export type XAIDevicePollResult =
  | { status: 'complete'; credentials: OAuthCredentials }
  | { status: 'pending'; nextPollMs: number; pending: XAIDeviceLoginPending }
  | { status: 'failed'; error: string };

/**
 * Start an xAI device-code login: request a user code and return the
 * serializable pending state for subsequent polls.
 */
export async function startXAIDeviceLogin(options?: { signal?: AbortSignal }): Promise<XAIDeviceLoginPending> {
  const response = await postForm(DEVICE_CODE_URL, { client_id: CLIENT_ID, scope: SCOPE }, options?.signal);

  if (!response.ok) {
    const text = await response.text().catch(() => '');
    throw new Error(`Failed to initiate xAI device authorization: ${response.status}${text ? ` ${text}` : ''}`);
  }

  const data = (await response.json()) as {
    device_code?: string;
    user_code?: string;
    verification_uri?: string;
    verification_uri_complete?: string;
    interval?: number;
    expires_in?: number;
  };

  if (!data.device_code || !data.user_code || !data.verification_uri) {
    throw new Error('xAI device authorization response missing required fields');
  }

  const url = validateVerificationUri(data.verification_uri_complete ?? data.verification_uri);

  return {

View on GitHub (pinned to 75dd419e61)

Solutions

Read the status/text in the message: 401/403 → check client_id credentials; 429 → back off and retry; 5xx → provider issue.
Verify the CLIENT_ID and SCOPE match the values registered for the xAI app.
Check network/proxy/firewall access to the xAI API host.
Retry with backoff during provider outages.

Defensive patterns

Strategy: retry

Validate before calling

// cheap reachability/config pre-check before starting device login
if (!CLIENT_ID) throw new Error('xAI CLIENT_ID is not configured');
if (!DEVICE_CODE_URL.startsWith('https://')) throw new Error('Device code URL must be https');

Try / catch

try {
  pending = await startXAIDeviceLogin({ signal });
} catch (e) {
  if (e instanceof Error && /status: 5\d\d|status: 429/.test(e.message)) {
    await backoff(); // transient outage or rate limit
    pending = await startXAIDeviceLogin({ signal });
  } // 401/403 → fix CLIENT_ID/scope before retrying
}

Prevention

Validate CLIENT_ID and SCOPE configuration at startup
Implement exponential backoff for 429/5xx responses
Ensure outbound network/proxy access to the xAI API host
Surface the status code (already in the message) to guide the fix

When it happens

Trigger: Any call that starts an xAI device login where postForm(DEVICE_CODE_URL, ...) resolves with response.ok === false (4xx/5xx from the provider).

Common situations: Invalid or unregistered CLIENT_ID (401/403); invalid scope requested; xAI API outage (5xx); corporate proxy blocking the request; rate limiting (429).

Related errors

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/4d304660ae03cd7b. Report an issue: GitHub.