router-for-me/CLIProxyAPI · error

xai device token: parse response: %w

Error message

xai device token: parse response: %w

What it means

The token endpoint's response body was read successfully but is not valid JSON, so json.Unmarshal into the token payload struct failed. OAuth token endpoints must return JSON; anything else (HTML error page, empty body, plain text) triggers this.

Source

Thrown at internal/auth/xai/xai.go:296

		}
	}()

	body, err := io.ReadAll(resp.Body)
	if err != nil {
		return nil, fmt.Errorf("xai device token: read response: %w", err), interval, false
	}

	var payload struct {
		Error            string `json:"error"`
		ErrorDescription string `json:"error_description"`
		AccessToken      string `json:"access_token"`
		RefreshToken     string `json:"refresh_token"`
		IDToken          string `json:"id_token"`
		TokenType        string `json:"token_type"`
		ExpiresIn        int    `json:"expires_in"`
	}
	if err = json.Unmarshal(body, &payload); err != nil {
		return nil, fmt.Errorf("xai device token: parse response: %w", err), interval, false
	}

	if payload.Error != "" {
		switch payload.Error {
		case "authorization_pending":
			return nil, nil, interval, true
		case "slow_down":
			nextInterval := interval + defaultPollInterval
			return nil, nil, nextInterval, true
		case "expired_token":
			return nil, fmt.Errorf("xai device code expired"), interval, false
		case "access_denied":
			return nil, fmt.Errorf("xai device authorization denied"), interval, false
		default:
			desc := strings.TrimSpace(payload.ErrorDescription)
			if desc != "" {
				return nil, fmt.Errorf("xai device token error: %s: %s", payload.Error, desc), interval, false
			}

View on GitHub (pinned to 78f0c4079e)

Solutions

1. Log the raw body (already available) to identify what was actually returned
2. Confirm the token endpoint URL via discovery
3. If a WAF/block page appears, fix network egress or allowlisting for the auth domain

if err != nil {
    var syntaxErr *json.SyntaxError
    if errors.As(err, &syntaxErr) || strings.Contains(err.Error(), "parse response") {
        log.Errorf("token endpoint returned non-JSON (gateway/WAF page?); inspect raw body")
    }
    return err
}

When it happens

Trigger: Non-JSON body from the token endpoint: an HTML 502/503 page from a gateway, an empty body, or a WAF/block page — with a status line that still allowed the read to succeed.

Common situations: Cloudflare/WAF challenge page returned instead of the API response; wrong endpoint that serves HTML; response encoding surprises from proxies.

Related errors

• invalid auth file: %w
• invalid auth file: %w
• failed to merge metadata: %w
• failed to write token to file: %w
• vertex credential: merge metadata failed: %w

AI-assisted analysis of router-for-me/CLIProxyAPI@78f0c4079e (2026-08-15). Data as JSON: /api/errors/010626234f64fc5e. Report an issue: GitHub.