mastra-ai/mastra · error

xAI device authorization returned an invalid verification_ur

Error message

xAI device authorization returned an invalid verification_uri: ${raw}

What it means

validateVerificationUri parses the verification_uri returned by the xAI device-authorization endpoint; if the value cannot be parsed as a URL at all, this error is thrown. The URI is what the user opens in a browser, so a malformed value means the provider response is unusable or hostile.

Source

Thrown at mastracode/sdk/src/auth/providers/xai.ts:42

// Refresh 5 minutes before actual expiry (same skew as Anthropic).
const REFRESH_SKEW_MS = 5 * 60 * 1000;

async function postForm(url: string, params: Record<string, string>, signal?: AbortSignal): Promise<Response> {
  return fetch(url, {
    method: 'POST',
    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
    body: new URLSearchParams(params).toString(),
    signal,
  });
}

/** The verification URI is opened by the user; only accept https URLs. */
function validateVerificationUri(raw: string): string {
  let parsed: URL;
  try {
    parsed = new URL(raw);
  } catch {
    throw new Error(`xAI device authorization returned an invalid verification_uri: ${raw}`);
  }
  if (parsed.protocol !== 'https:') {
    throw new Error(`xAI device authorization returned a non-https verification_uri: ${raw}`);
  }
  return parsed.toString();
}

function credentialsFromTokenResponse(data: unknown, previousRefreshToken?: string): OAuthCredentials {
  const record = (data ?? {}) as Record<string, unknown>;
  const access = record.access_token;
  if (typeof access !== 'string' || access.length === 0) {
    throw new Error('xAI token response missing access_token');
  }

  // xAI may not rotate the refresh token on refresh; keep the previous one.
  const refresh =
    typeof record.refresh_token === 'string' && record.refresh_token.length > 0
      ? record.refresh_token

View on GitHub (pinned to 75dd419e61)

Solutions

1. Log the raw device-authorization response body to see what verification_uri actually contained.
2. Ensure the device-code endpoint URL is the official xAI endpoint (no overridden base URL/proxy).
3. Retry the device login; if persistent, report a provider-side contract change and upgrade the SDK.
4. If behind a corporate proxy, bypass it for the xAI API hosts.

function isParseableUrl(raw: unknown): raw is string {
  if (typeof raw !== 'string' || raw.length === 0) return false;
  try { new URL(raw); return true; } catch { return false; }
}

try {
  const pending = await startXAIDeviceLogin();
} catch (e) {
  if (e instanceof Error && e.message.includes('invalid verification_uri')) {
    // log raw response for provider debugging, then retry
    console.error('xAI returned unusable verification_uri; retrying device login');
  }
}

When it happens

Trigger: startXAIDeviceLogin receives a device-authorization response whose verification_uri (or verification_uri_complete) is not a valid URL string (e.g. empty, relative path, HTML error page fragment).

Common situations: xAI API contract change or regression; a proxy/captive portal intercepting the request and returning non-JSON/garbage that still passes the field check; pointing DEVICE_CODE_URL at a mock or wrong endpoint during local development.

Related errors

• xAI device authorization returned a non-https verification_u
• Failed to initiate xAI device authorization: ${response.stat
• xAI device authorization response missing required fields
• Invalid state token format
• Login cancelled

AI-assisted analysis of mastra-ai/mastra@75dd419e61 (2026-08-30). Data as JSON: /api/errors/a5e8f3835d7a5324. Report an issue: GitHub.