Sign-in is not available for this deployment. Set XAI_API_KE

Error message

Sign-in is not available for this deployment. Set XAI_API_KEY instead.

What it means

run_cli_login_steps determined that the device-code flow should be used (per cli_should_device and the --device-auth override), but config.grok_com_config.oauth2 is None, meaning no OAuth2 client configuration exists to drive the device flow. The deployment therefore cannot perform interactive sign-in and the user is told to use a static API key.

Source

Thrown at crates/codegen/xai-grok-shell/src/auth/flow.rs:878

        &grok_home::grok_home(),
        config.grok_com_config.clone(),
    ));
    crate::agent::init::update_telemetry_config(config, &auth_manager);
    let result = run_cli_login_steps(config, &auth_manager, oauth, device_auth).await;
    xai_grok_telemetry::session_ctx::drain_pending(xai_grok_telemetry::session_ctx::CLI_DRAIN)
        .await;
    result
}
async fn run_cli_login_steps(
    config: &crate::agent::config::Config,
    auth_manager: &Arc<AuthManager>,
    oauth: bool,
    device_auth: bool,
) -> anyhow::Result<()> {
    let login_override = LoginTransportOverride::from_flags(oauth, device_auth);
    let authenticated = if cli_should_use_device(&config.grok_com_config, login_override).await {
        if config.grok_com_config.oauth2.is_none() {
            anyhow::bail!("Sign-in is not available for this deployment. Set XAI_API_KEY instead.");
        }
        let (auth, did_auth) = run_auth_flow_interactive(
            auth_manager,
            &config.grok_com_config,
            None,
            None,
            None,
            LoginTransportOverride::Preresolved(true),
        )
        .await?;
        if did_auth {
            report_signed_in(&auth);
        }
        auth
    } else {
        if device_auth && crate::auth::oidc::is_configured(&config.grok_com_config) {
            eprintln!(
                "Device-code login isn't available for your SSO provider; using browser sign-in."

View on GitHub (pinned to bc7f02eddd)

Solutions

Set the XAI_API_KEY environment variable and skip interactive device login.
Run `grok login` once (browser flow) to provision the OAuth2 configuration, then retry `--device-auth`.
Check that your config file contains a grok_com.oauth2 section and that GROK_HOME points to it.
In enterprise deployments, confirm with your administrator whether device sign-in is supported at all.

Example fix

// before
grok login --device-auth   # no oauth2 config present
// after
export XAI_API_KEY=xai-...
# or provision config first:
grok login

Defensive patterns

Strategy: validation

Validate before calling

// decide login mode up front
if want_device_login && config.grok_com_config.oauth2.is_none() {
    if let Ok(key) = std::env::var("XAI_API_KEY") {
        eprintln!("OAuth2 unavailable; using XAI_API_KEY.");
    } else {
        eprintln!("Run `grok login` first to provision OAuth2 config.");
        return;
    }
}

Try / catch

match run_cli_login(&config, oauth, device_auth, false).await {
    Err(e) if e.to_string().contains("Sign-in is not available for this deployment") => {
        eprintln!("Set XAI_API_KEY or run `grok login` to provision OAuth2 config.");
    }
    other => other?,
}

Prevention

Provision OAuth2 config via `grok login` before offering --device-auth in scripts.
Fall back to XAI_API_KEY automatically when oauth2 config is absent.
Validate config completeness (grok_com.oauth2 section) at CLI startup.
In headless deployments, standardize on API keys instead of device flow.

When it happens

Trigger: run_cli_login_steps runs with device_auth=true (or device flow auto-selected) and config.grok_com_config.oauth2.is_none() — raised from run_cli_login when device login is requested in a deployment without OAuth2 config.

Common situations: Fresh install without `grok login` having ever provisioned oauth2 config; enterprise/headless environment where only XAI_API_KEY is supported; config file missing the oauth2 section after an upgrade or migration.

Related errors

AI-assisted analysis of xai-org/grok-build@bc7f02eddd (2026-08-31). Data as JSON: /api/errors/bb88d0e4effc3179. Report an issue: GitHub.