router-for-me/CLIProxyAPI · error

kimi: access denied by user

Error message

kimi: access denied by user

What it means

The token endpoint returned OAuth error 'access_denied': the user actively rejected the authorization request at the Kimi consent page (or an admin policy denies the client). This is a deliberate user action, not a malfunction.

Source

Thrown at internal/auth/kimi/kimi.go:322

		TokenType        string  `json:"token_type"`
		ExpiresIn        float64 `json:"expires_in"`
		Scope            string  `json:"scope"`
	}

	if err = json.Unmarshal(bodyBytes, &oauthResp); err != nil {
		return nil, fmt.Errorf("kimi: failed to parse token response: %w", err), false
	}

	if oauthResp.Error != "" {
		switch oauthResp.Error {
		case "authorization_pending":
			return nil, nil, true // Continue polling
		case "slow_down":
			return nil, nil, true // Continue polling (with increased interval handled by caller)
		case "expired_token":
			return nil, fmt.Errorf("kimi: device code expired"), false
		case "access_denied":
			return nil, fmt.Errorf("kimi: access denied by user"), false
		default:
			return nil, fmt.Errorf("kimi: OAuth error: %s - %s", oauthResp.Error, oauthResp.ErrorDescription), false
		}
	}

	if oauthResp.AccessToken == "" {
		return nil, fmt.Errorf("kimi: empty access token in response"), false
	}

	var expiresAt int64
	if oauthResp.ExpiresIn > 0 {
		expiresAt = time.Now().Unix() + int64(oauthResp.ExpiresIn)
	}

	return &KimiTokenData{
		AccessToken:  oauthResp.AccessToken,
		RefreshToken: oauthResp.RefreshToken,
		TokenType:    oauthResp.TokenType,

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Ask the user whether they denied the prompt; if accidental, restart login and click Approve
2. Make sure the browser session used at the verification URL is logged into the intended Kimi account
3. If an org policy blocks the client, use a personal account or get the client allow-listed

func isAccessDeniedErr(err error) bool {
    return err != nil && strings.Contains(err.Error(), "access denied by user")
}

if err != nil && strings.Contains(err.Error(), "access denied by user") {
    // prompt the user: did they mean to deny? restart flow if not
}

When it happens

Trigger: User clicks 'Deny'/'Cancel' on the Kimi verification page; entering the user_code on someone else's account that refuses consent; enterprise policy auto-denying the OAuth client.

Common situations: User changes their mind mid-login, wrong account signed into the browser when verifying, organizational OAuth allow-lists blocking the Kimi Code client.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• kimi: failed to create device code request: %w
• kimi: device code request failed: %w
• kimi: failed to read device code response: %w
• kimi: device code request failed with status %d: %s
• kimi: failed to parse device code response: %w

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/c984517eb36bfe8e. Report an issue: GitHub.