router-for-me/CLIProxyAPI · error

xai device authorization denied

Error message

xai device authorization denied

What it means

The token endpoint returned error=access_denied. The user (or an admin policy) explicitly rejected the device authorization request at the verification page, so no tokens will ever be issued for this code.

Source

Thrown at internal/auth/xai/xai.go:309

		IDToken          string `json:"id_token"`
		TokenType        string `json:"token_type"`
		ExpiresIn        int    `json:"expires_in"`
	}
	if err = json.Unmarshal(body, &payload); err != nil {
		return nil, fmt.Errorf("xai device token: parse response: %w", err), interval, false
	}

	if payload.Error != "" {
		switch payload.Error {
		case "authorization_pending":
			return nil, nil, interval, true
		case "slow_down":
			nextInterval := interval + defaultPollInterval
			return nil, nil, nextInterval, true
		case "expired_token":
			return nil, fmt.Errorf("xai device code expired"), interval, false
		case "access_denied":
			return nil, fmt.Errorf("xai device authorization denied"), interval, false
		default:
			desc := strings.TrimSpace(payload.ErrorDescription)
			if desc != "" {
				return nil, fmt.Errorf("xai device token error: %s: %s", payload.Error, desc), interval, false
			}
			return nil, fmt.Errorf("xai device token error: %s", payload.Error), interval, false
		}
	}

	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("xai device token request failed with status %d: %s", resp.StatusCode, strings.TrimSpace(string(body))), interval, false
	}
	if strings.TrimSpace(payload.AccessToken) == "" {
		return nil, fmt.Errorf("xai device token response missing access_token"), interval, false
	}

	email, subject := parseJWTIdentity(payload.IDToken)
	return buildTokenData(payload.AccessToken, payload.RefreshToken, payload.IDToken, payload.TokenType, payload.ExpiresIn, email, subject), nil, interval, false

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Restart the flow and have the user explicitly approve the consent prompt
2. Verify the user signs in with an account permitted to use the xAI integration
3. If an org policy is blocking it, use a different authorization method or request an exemption

if err != nil {
    if strings.Contains(err.Error(), "authorization denied") {
        // user or policy rejected: do not retry automatically; ask user to re-run login
        return fmt.Errorf("xAI authorization was denied by the user or policy: %w", err)
    }
    return err
}

When it happens

Trigger: User clicks 'Deny'/'Cancel' on the xAI consent page, or an org policy auto-denies the device flow for the client_id.

Common situations: User mistook the prompt for phishing and denied it; organization SSO policy blocks device authorization for third-party clients; wrong account signed in.

Related errors

• kimi: access denied by user
• xai device code: response missing device_code
• xai device code: response missing user_code
• xai device code: response missing verification URI
• xai device code expired

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/fb3ce7a457e23a13. Report an issue: GitHub.