What causes "xai device token error: %s" in router-for-me/CLIProxyAPI?

Retry after a short backoff for transient codes like temporarily_unavailable

xai device token error: %s

Error message

xai device token error: %s

What it means

Same catch-all branch as error 292, but the server supplied no error_description, so only the bare error code is reported. This makes diagnosis harder because the raw code (e.g. temporarily_unavailable) is all you get.

Source

Thrown at internal/auth/xai/xai.go:315

	}

	if payload.Error != "" {
		switch payload.Error {
		case "authorization_pending":
			return nil, nil, interval, true
		case "slow_down":
			nextInterval := interval + defaultPollInterval
			return nil, nil, nextInterval, true
		case "expired_token":
			return nil, fmt.Errorf("xai device code expired"), interval, false
		case "access_denied":
			return nil, fmt.Errorf("xai device authorization denied"), interval, false
		default:
			desc := strings.TrimSpace(payload.ErrorDescription)
			if desc != "" {
				return nil, fmt.Errorf("xai device token error: %s: %s", payload.Error, desc), interval, false
			}
			return nil, fmt.Errorf("xai device token error: %s", payload.Error), interval, false
		}
	}

	if resp.StatusCode != http.StatusOK {
		return nil, fmt.Errorf("xai device token request failed with status %d: %s", resp.StatusCode, strings.TrimSpace(string(body))), interval, false
	}
	if strings.TrimSpace(payload.AccessToken) == "" {
		return nil, fmt.Errorf("xai device token response missing access_token"), interval, false
	}

	email, subject := parseJWTIdentity(payload.IDToken)
	return buildTokenData(payload.AccessToken, payload.RefreshToken, payload.IDToken, payload.TokenType, payload.ExpiresIn, email, subject), nil, interval, false
}

// RefreshTokens refreshes an xAI access token.
func (a *XAIAuth) RefreshTokens(ctx context.Context, refreshToken, tokenEndpoint string) (*TokenData, error) {
	if strings.TrimSpace(refreshToken) == "" {
		return nil, fmt.Errorf("xai token refresh: refresh token is required")

View on GitHub (pinned to 78f0c4079e)

Solutions

Retry after a short backoff for transient codes like temporarily_unavailable
Look the error code up in the current OAuth/xAI error documentation
Log the full response body and status at the call site for correlation with server logs

Defensive patterns

Strategy: retry

Try / catch

if err != nil && strings.Contains(err.Error(), "device token error:") {
    // no description available: retry once for transient codes, then fail with the raw code
    log.Warnf("xAI token error without description: %v", err)
    return retryOnceThenFail(err)
}

Prevention

Log the full response body and status at the call site since the error lacks a description
Map known bare codes (temporarily_unavailable, server_error) to retry policies

When it happens

Trigger: Token exchange returns {"error":"some_code"} with an absent or whitespace-only error_description.

Common situations: Server transient failures (temporarily_unavailable) that omit descriptions; stricter API versions dropping descriptive text; proxied responses stripped of detail.

Related errors

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/4fa0daa9e16565cc. Report an issue: GitHub.