No OAuth2 configuration available. Run `grok login` to authe

Error message

No OAuth2 configuration available. Run `grok login` to authenticate, or contact your administrator if you use enterprise SSO.

What it means

run_auth_flow_steps exhausted all authentication options: neither an enterprise OIDC configuration nor an xAI OAuth2 configuration is present in the config. Without any OAuth2 setup, no interactive sign-in flow can run, so the client bails with guidance to authenticate or contact an administrator.

Source

Thrown at crates/codegen/xai-grok-shell/src/auth/flow.rs:640

                {
                    tracing::warn!(
                        "auth: device flow unavailable (404), falling back to loopback login"
                    );
                }
                other => return other,
            }
        }
        return crate::auth::oidc::run_login_flow_with_config(
            &oauth2_cfg.as_oidc(),
            auth_manager,
            channels,
        )
        .await;
    }
    tracing::error!(
        "auth: no OAuth2 configuration available (neither enterprise OIDC nor xAI OAuth2 configured)"
    );
    anyhow::bail!(
        "No OAuth2 configuration available. Run `grok login` to authenticate, or contact your administrator if you use enterprise SSO."
    )
}
/// Non-interactive auth refresh: returns valid credentials if available without
/// ever triggering interactive login (browser, device code, etc.).
///
/// Tries in order:
/// 1. Cached credentials (non-expired)
/// 2. OIDC silent refresh (if expired token has a refresh_token)
/// 3. External auth provider command (if configured)
///
/// Returns `None` when no valid credentials can be obtained non-interactively.
pub async fn try_ensure_fresh_auth(grok_com_config: &GrokComConfig) -> Option<GrokAuth> {
    try_ensure_fresh_auth_with(&build_startup_auth_manager(grok_com_config)).await
}
/// Builds and configures the startup `AuthManager`; the policy helpers below
/// take it injected so tests can substitute their own.
fn build_startup_auth_manager(grok_com_config: &GrokComConfig) -> Arc<AuthManager> {

View on GitHub (pinned to bc7f02eddd)

Solutions

Run `grok login` to perform interactive authentication and populate the OAuth2 config.
Set the XAI_API_KEY environment variable if you authenticate via API key rather than OAuth2.
For enterprise SSO, ask your administrator to deploy the OIDC configuration.
Verify GROK_HOME / config path points to the file that actually contains oauth2 settings.

Example fix

// before: no credentials
$ grok login --device-auth
// after: configure auth first
export XAI_API_KEY=xai-...
# or
grok login

Defensive patterns

Strategy: validation

Validate before calling

// before invoking any login flow, check config availability
if config.grok_com_config.oauth2.is_none() && std::env::var_os("XAI_API_KEY").is_none() {
    eprintln!("No OAuth2 config and no XAI_API_KEY; run `grok login` first.");
}

Try / catch

match run_auth_flow(&auth_manager, &config).await {
    Err(e) if e.to_string().contains("No OAuth2 configuration available") => {
        eprintln!("Run `grok login` or export XAI_API_KEY before retrying.");
    }
    other => other?,
}

Prevention

Run `grok login` once after install to provision the OAuth2 config.
Keep XAI_API_KEY set in CI/containers where interactive login is impossible.
Verify GROK_HOME points at the config file that actually holds oauth2 settings.
For enterprise SSO, confirm OIDC settings are deployed before distributing the CLI.

When it happens

Trigger: run_auth_flow_steps reaches the end after enterprise OIDC and xAI OAuth2 branches were both unavailable — i.e. config.grok_com_config.oauth2 is None and no enterprise SSO config exists, while an auth flow was requested (e.g. device-auth path in run_cli_login_steps with oauth2.is_none()).

Common situations: Fresh install with no `grok login` ever run and no config file; XAI_API_KEY absent in a build that requires OAuth2; enterprise deployment where the admin never provisioned OIDC settings; config file corrupted or pointing at the wrong grok_home.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/ee2baaa2ede1f6e6. Report an issue: GitHub.