--devbox mints an xAI credential, which this build cannot us

Error message

--devbox mints an xAI credential, which this build cannot use

What it means

run_cli_login rejects the --devbox flag when the active auth backend is not an xAI authority, because devbox login mints an xAI-specific credential that the current build cannot consume. The check fails fast before running the devbox flow.

Source

Thrown at crates/codegen/xai-grok-shell/src/auth/flow.rs:854

            .await
            .map(Some)
    }
}
/// Unified `grok login` handler for CLI entry points (tui, pager).
///
/// Precedence: `--oauth` forces loopback, `--device-auth` forces device,
/// otherwise `GROK_LOGIN_DEVICE_FLOW` env / `[auth] login_device_flow` config /
/// loopback default. Both transports run through `run_auth_flow_inner` so the
/// external auth provider and devbox auto-migration are tried first.
pub async fn run_cli_login(
    config: &crate::agent::config::Config,
    oauth: bool,
    device_auth: bool,
    devbox: bool,
) -> anyhow::Result<()> {
    if devbox {
        if !ActiveAuthBackend::default().is_xai_authority() {
            anyhow::bail!("--devbox mints an xAI credential, which this build cannot use");
        }
        let auth = super::devbox_login::run_devbox_login(config).await?;
        return apply_post_login_config(auth).await;
    }
    let auth_manager = Arc::new(AuthManager::new(
        &grok_home::grok_home(),
        config.grok_com_config.clone(),
    ));
    crate::agent::init::update_telemetry_config(config, &auth_manager);
    let result = run_cli_login_steps(config, &auth_manager, oauth, device_auth).await;
    xai_grok_telemetry::session_ctx::drain_pending(xai_grok_telemetry::session_ctx::CLI_DRAIN)
        .await;
    result
}
async fn run_cli_login_steps(
    config: &crate::agent::config::Config,
    auth_manager: &Arc<AuthManager>,
    oauth: bool,

View on GitHub (pinned to bc7f02eddd)

Solutions

Drop the --devbox flag and authenticate with the backend this build supports (grok login or XAI_API_KEY).
Use a build configured against the xAI authority if you specifically need devbox credentials.
If you believe the backend is wrong, check the build's authority/backend configuration before login.
For enterprise deployments, request credentials through your administrator's SSO flow instead.

Example fix

// before
grok login --devbox   # non-xAI backend build
// after
grok login            # or: export XAI_API_KEY=...

Defensive patterns

Strategy: validation

Validate before calling

// only pass --devbox when the backend is xAI-authority
if devbox && !ActiveAuthBackend::default().is_xai_authority() {
    eprintln!("--devbox unsupported in this build; use `grok login` or XAI_API_KEY.");
    return;
}

Try / catch

match run_cli_login(&config, oauth, device_auth, devbox).await {
    Err(e) if e.to_string().contains("--devbox mints an xAI credential") => {
        eprintln!("This build can't use devbox credentials; authenticating without --devbox.");
        run_cli_login(&config, oauth, device_auth, false).await?;
    }
    other => other?,
}

Prevention

Document that --devbox requires an xAI-authority build.
Hide or disable the --devbox flag in enterprise/forked builds.
Choose the login method based on ActiveAuthBackend at startup.
In CI, avoid devbox and rely on XAI_API_KEY.

When it happens

Trigger: run_cli_login invoked with devbox=true while ActiveAuthBackend::default().is_xai_authorization() returns false — i.e. the build is configured against a non-xAI authority (e.g. enterprise OIDC or a third-party IdP).

Common situations: Running --devbox in an enterprise build where the default backend is the company IdP; using a forked/rebranded build where the xAI authority is disabled; CI images configured for enterprise SSO.

Related errors

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/e9315095cdc99066. Report an issue: GitHub.