What causes "Authorization denied. The user rejected the request." in xai-org/grok-build?

Retry the login and click Allow/Authorize at the verification URL.

Authorization denied. The user rejected the request.

Error message

Authorization denied. The user rejected the request.

What it means

The token endpoint responded with error=access_denied, meaning the user actively rejected the device-authorization request at the verification page. The client maps this OAuth2 error to a clear message that no token will be issued.

Source

Thrown at crates/codegen/xai-grok-shell/src/auth/device_code.rs:266

            let tokens: TokenOk = resp.json().await?;
            let auth = build_auth(&tokens, issuer, client_id, auth_manager).await?;
            return Ok((auth, true));
        }

        let err: TokenErr = resp.json().await?;
        let detail = err.error_description.as_deref().unwrap_or(&err.error);
        match err.error.as_str() {
            "authorization_pending" => {
                // User hasn't acted yet -- keep polling.
                continue;
            }
            "slow_down" => {
                poll_interval += std::time::Duration::from_secs(DEVICE_SLOW_DOWN_INCREMENT_SECS);
                continue;
            }
            "access_denied" => {
                tracing::warn!(description = detail, "device auth authorization denied");
                anyhow::bail!("Authorization denied. The user rejected the request.");
            }
            "expired_token" => {
                tracing::warn!(description = detail, "device auth token expired");
                anyhow::bail!("Device code expired. Run `grok login --device-auth` again.");
            }
            other => {
                tracing::warn!(
                    error = other,
                    description = detail,
                    "device auth token exchange failed"
                );
                anyhow::bail!("Token exchange error: {detail}");
            }
        }
    }
}

/// Device-code login shared by the TUI and CLI.

View on GitHub (pinned to bc7f02eddd)

Solutions

Retry the login and click Allow/Authorize at the verification URL.
Re-run `grok login --device-auth` to get a fresh device code (the old one is consumed).
If rejections are unintentional, check browser session/profile — you may be signed into the wrong account.
If policy blocks consent, contact your administrator or use XAI_API_KEY instead.

Defensive patterns

Strategy: try-catch

Try / catch

match complete_device_code_login(&client, &pending).await {
    Err(e) if e.to_string().contains("Authorization denied") => {
        eprintln!("You declined the request. Re-run `grok login --device-auth` and choose Allow.");
    }
    other => other?,
}

Prevention

Confirm the correct account is active in the browser before opening the verification URL.
Read the consent screen before clicking; use Deny only intentionally.
On shared machines, use a private/incognito window so the right account authorizes.
If rejections recur, check for security tooling or admin policy auto-denying consent.

When it happens

Trigger: complete_device_code_login polls the token endpoint and receives {"error":"access_denied"} after the user clicked Deny/Cancel on the verification_uri page.

Common situations: User misclicks Deny; a shared machine's previous session rejects on behalf of the intended user; security policy or an admin consents screen leads the user to cancel.

Related errors

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/d3fb2bc616fb9bd8. Report an issue: GitHub.