Invalid Kimi For Coding device authorization response

Error message

Invalid Kimi For Coding device authorization response

What it means

After a 2xx device-authorization response, startKimiCodingDeviceLogin validates that device_code, user_code, verification_uri, and verification_uri_complete are all present (with URIs vetted by trustedHttpUrl). If the server returned an OK status but the payload lacks any of these required device-flow fields, the library throws this contract error instead of returning a partially usable pending login.

Source

Thrown at mastracode/sdk/src/auth/providers/kimi-coding.ts:140

  if (!response.ok) {
    const text = await response.text().catch(() => '');
    throw new Error(`Kimi For Coding device authorization failed: ${response.status}${text ? ` ${text}` : ''}`);
  }

  const data = await readJson(response);
  const deviceCode = data?.device_code;
  const userCode = data?.user_code;
  const verificationUri = trustedHttpUrl(data?.verification_uri);
  const verificationUriComplete = trustedHttpUrl(data?.verification_uri_complete);
  if (
    typeof deviceCode !== 'string' ||
    !deviceCode ||
    typeof userCode !== 'string' ||
    !userCode ||
    !verificationUri ||
    !verificationUriComplete
  ) {
    throw new Error('Invalid Kimi For Coding device authorization response');
  }

  const interval = data?.interval;
  const expiresIn = data?.expires_in;
  return {
    clientId,
    deviceId,
    deviceCode,
    userCode,
    url: verificationUriComplete,
    instructions: `Enter code: ${userCode}`,
    state: createDeviceCodePollState({
      intervalSeconds:
        typeof interval === 'number' && Number.isFinite(interval) && interval > 0
          ? interval
          : DEFAULT_POLL_INTERVAL_SECONDS,
      expiresInSeconds:
        typeof expiresIn === 'number' && Number.isFinite(expiresIn) && expiresIn > 0

View on GitHub (pinned to 75dd419e61)

Solutions

Capture and inspect the raw response body to see which field is missing or renamed
Retry the device login — a transient server issue may resolve it
Verify you are hitting the official endpoint (no proxy rewriting)
Update the SDK if Kimi changed the device-flow response contract

Defensive patterns

Strategy: fallback

Validate before calling

// Pre-flight shape check on a raw response, mirroring the library's contract
function isDeviceAuthPayload(d) {
  return !!d && typeof d === 'object' && !!d.device_code && typeof d.user_code === 'string' &&
    !!d.verification_uri && !!d.verification_uri_complete;
}

Type guard

function isDeviceAuthResponse(d: unknown): d is { device_code: string; user_code: string; verification_uri: string; verification_uri_complete: string } {
  const o = d as Record<string, unknown>;
  return !!o && typeof o === 'object' && typeof o.device_code === 'string' && !!o.device_code &&
    typeof o.user_code === 'string' && !!o.user_code &&
    typeof o.verification_uri === 'string' && !!o.verification_uri &&
    typeof o.verification_uri_complete === 'string' && !!o.verification_uri_complete;
}

Try / catch

try {
  pending = await startKimiCodingDeviceLogin();
} catch (err) {
  if (err instanceof Error && err.message.includes('Invalid Kimi For Coding device authorization response')) {
    // 2xx but incomplete payload: retry once; if persistent, surface for SDK/API-version update
    pending = await startKimiCodingDeviceLogin();
  } else throw err;
}

Prevention

Retry once on contract errors — transient server issues often produce incomplete payloads
Capture the raw body on failure to detect field renames or proxy rewriting
Ensure no middlebox rewrites JSON responses from the auth endpoint
Update the SDK when Kimi changes the device-flow response contract

When it happens

Trigger: The authorization endpoint responds 200 with an incomplete payload: an error object with 200 status, truncated body, an API version that renamed fields, or a proxy stripping/rewriting the JSON.

Common situations: Kimi API change altering device-flow field names; captive portal/proxy returning 200 with HTML; server-side partial outage producing malformed success responses.

Related errors

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/5fdb759721deab61. Report an issue: GitHub.