router-for-me/CLIProxyAPI · error

kimi: device code request failed: %w

Error message

kimi: device code request failed: %w

What it means

The POST to Kimi's device-authorization endpoint failed at the transport level — the request was built but httpClient.Do could not complete DNS, TCP, TLS, or was canceled mid-flight. The device flow cannot even show the user a verification URL until this succeeds. The wrapped error names the underlying transport cause.

Source

Thrown at internal/auth/kimi/kimi.go:197

// RequestDeviceCode initiates the device flow by requesting a device code from Kimi.
func (c *DeviceFlowClient) RequestDeviceCode(ctx context.Context) (*DeviceCodeResponse, error) {
	data := url.Values{}
	data.Set("client_id", kimiClientID)

	req, err := http.NewRequestWithContext(ctx, http.MethodPost, kimiDeviceCodeURL, strings.NewReader(data.Encode()))
	if err != nil {
		return nil, fmt.Errorf("kimi: failed to create device code request: %w", err)
	}
	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
	req.Header.Set("Accept", "application/json")
	for k, v := range c.commonHeaders() {
		req.Header.Set(k, v)
	}

	resp, err := c.httpClient.Do(req)
	if err != nil {
		return nil, fmt.Errorf("kimi: device code request failed: %w", err)
	}
	defer func() {
		if errClose := resp.Body.Close(); errClose != nil {
			log.Errorf("kimi device code: close body error: %v", errClose)
		}
	}()

	bodyBytes, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, fmt.Errorf("kimi: failed to read device code response: %w", err)
	}

	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("kimi: device code request failed with status %d: %s", resp.StatusCode, string(bodyBytes))
	}

	var deviceCode DeviceCodeResponse
	if err = json.Unmarshal(bodyBytes, &deviceCode); err != nil {

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Verify reachability directly: `curl -v https://auth.kimi.com/api/oauth/device_authorization`.
2. Fix or clear HTTP_PROXY/HTTPS_PROXY/NO_PROXY for the process.
3. If TLS-intercepted, trust the proxy CA (SSL_CERT_FILE) or bypass the auth host.
4. Retry after network/DNS is confirmed working; transport blips are self-healing.
5. If the host is regionally blocked, run login from a network that can reach auth.kimi.com.

// Pre-flight reachability check before starting the device flow
if _, err := net.DialTimeout("tcp", "auth.kimi.com:443", 5*time.Second); err != nil {
    return fmt.Errorf("auth.kimi.com unreachable: %w", err)
}

dc, err := c.RequestDeviceCode(ctx)
if err != nil {
    var netErr net.Error
    if errors.As(err, &netErr) {
        // transport failure: fix network/proxy, then restart device flow
        log.Warnf("kimi device endpoint unreachable: %v", err)
    }
}

When it happens

Trigger: No route to auth.kimi.com (blocked in region/firewall); DNS failure for auth.kimi.com; proxy env vars (HTTP(S)_PROXY) pointing to an unreachable proxy; TLS interception rejecting Kimi's certificate; context canceled during the round trip.

Common situations: auth.kimi.com unreachable from corporate or regional networks; proxy misconfiguration in the shell launching the process; VPN split-tunnel excluding the auth host; transient provider/network outage.

Related errors

• claude oauth tls: dial upstream: %w
• antigravity token exchange: execute request: %w
• execute request: %w
• fetch Claude OAuth %s: %w
• token exchange request failed: %w

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/49e86bb3ae1cad17. Report an issue: GitHub.