xAI device authorization returned a non-https verification_u

Error message

xAI device authorization returned a non-https verification_uri: ${raw}

What it means

validateVerificationUri only accepts https URLs for the verification_uri because users open it in a browser to authorize the device. A parseable URL with a non-https protocol (http:, javascript:, etc.) is rejected to prevent credential leakage or injection.

Source

Thrown at mastracode/sdk/src/auth/providers/xai.ts:45

async function postForm(url: string, params: Record<string, string>, signal?: AbortSignal): Promise<Response> {
  return fetch(url, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams(params).toString(),
    signal,
  });
}

/** The verification URI is opened by the user; only accept https URLs. */
function validateVerificationUri(raw: string): string {
  let parsed: URL;
  try {
    parsed = new URL(raw);
  } catch {
    throw new Error(`xAI device authorization returned an invalid verification_uri: ${raw}`);
  }
  if (parsed.protocol !== 'https:') {
    throw new Error(`xAI device authorization returned a non-https verification_uri: ${raw}`);
  }
  return parsed.toString();
}

function credentialsFromTokenResponse(data: unknown, previousRefreshToken?: string): OAuthCredentials {
  const record = (data ?? {}) as Record<string, unknown>;
  const access = record.access_token;
  if (typeof access !== 'string' || access.length === 0) {
    throw new Error('xAI token response missing access_token');
  }

  // xAI may not rotate the refresh token on refresh; keep the previous one.
  const refresh =
    typeof record.refresh_token === 'string' && record.refresh_token.length > 0
      ? record.refresh_token
      : previousRefreshToken;
  if (!refresh) {
    throw new Error('xAI token response missing refresh_token');

View on GitHub (pinned to 75dd419e61)

Solutions

Inspect the raw verification_uri in the response and confirm it starts with https://.
Remove any HTTP proxy/interception for xAI API hosts that could rewrite URLs.
Use only the official xAI device-code endpoint; verify no custom base URL override is set.
If the provider legitimately changed scheme, update/upgrade the SDK after confirming it is official.

Defensive patterns

Strategy: validation

Type guard

function isHttpsUrl(raw: unknown): raw is string {
  if (typeof raw !== 'string') return false;
  try { return new URL(raw).protocol === 'https:'; } catch { return false; }
}

Try / catch

try {
  await openXaiVerificationPage(pending.url);
} catch (e) {
  if (e instanceof Error && e.message.includes('non-https verification_uri')) {
    // treat as potentially MITM'd/misconfigured provider; abort, never open the URL
    abortDeviceLogin();
  }
}

Prevention

Never disable or bypass the https check on verification URLs
Use only the official xAI endpoints (no http mocks in production paths)
Route xAI API traffic through trusted, TLS-preserving networks only
If a provider change is suspected, verify the scheme change officially before updating code

When it happens

Trigger: startXAIDeviceLogin gets a device-authorization response where verification_uri / verification_uri_complete parses as a URL but parsed.protocol !== 'https:'.

Common situations: Provider misconfiguration returning http:// URLs; a local mock/stub server in development; a man-in-the-middle or compromised endpoint serving insecure URLs.

Related errors

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/8f53081472cdeabe. Report an issue: GitHub.