xtekky/gpt4free · critical · MissingAuthError

Invalid secrets

Error message

Invalid secrets

What it means

Grok's conversation endpoint returned HTTP 403, which the provider interprets as authentication failure and raises as MissingAuthError('Invalid secrets'). Grok here is driven by browser-derived cookies (auth_result.cookies), so 403 means those cookies or tokens are expired, revoked, or never valid for grok.com.

Source

Thrown at g4f/Provider/needs_auth/Grok.py:214

        )

        async with StreamSession(**auth_result.get_dict()) as session:
            payload = await cls._prepare_payload(model, prompt)

            # Add voice mode support flag (for future use)
            if kwargs.get("enable_voice", False):
                payload["enableVoiceMode"] = True

            if conversation_id is None:
                url = f"{cls.conversation_url}/new"
            else:
                url = f"{cls.conversation_url}/{conversation_id}/responses"

            async with session.post(
                url, json=payload, headers={"x-xai-request-id": str(uuid.uuid4())}
            ) as response:
                if response.status == 403:
                    raise MissingAuthError("Invalid secrets")
                auth_result.cookies = merge_cookies(auth_result.cookies, response)
                await raise_for_status(response)

                thinking_duration = None
                deep_search_active = False

                async for line in response.iter_lines():
                    if line:
                        try:
                            json_data = json.loads(line)
                            result = json_data.get("result", {})

                            if conversation_id is None:
                                conversation_id = result.get("conversation", {}).get(
                                    "conversationId"
                                )

                            response_data = result.get("response", {})

View on GitHub (pinned to 973504e177)

Solutions

1. Re-harvest fresh grok.com cookies (log in, export cookies, pass them to the provider or update the cookie jar) and retry
2. Catch MissingAuthError and route re-auth automatically before retrying once
3. Use a residential or clean egress IP if Cloudflare is the trigger (403 with challenge HTML body)
4. Update g4f; Grok's internal endpoints and required headers change often

def grok_cookies_present(cookies: dict) -> bool:
    return bool(cookies.get("sso") and cookies.get("sso-rw"))

if not grok_cookies_present(cookies):
    raise ConfigurationError("refresh grok.com cookies before using this provider")

from g4f.errors import MissingAuthError
try:
    async for chunk in Grok.create_async_generator(model, messages):
        ...
except MissingAuthError as e:
    if "Invalid secrets" in str(e):
        await refresh_grok_cookies()   # re-harvest from a logged-in browser
        async for chunk in Grok.create_async_generator(model, messages):
            ...

When it happens

Trigger: POST to the /responses conversation endpoint with stale sso/sso-rw cookies; Cloudflare challenge blocking the API path; account logged out in the browser so cookies no longer authorize API calls.

Common situations: Cookies harvested days earlier and since rotated; using grok.com cookies for an account without access; Cloudflare bot detection triggered by datacenter IPs; g4f version outdated relative to Grok's endpoint changes.

Related errors

• Response status: {response.status}
• Failed to obtain Turnstile token for DeepInfra request.
• Ollama session cookie is invalid or expired.
• Response {response.status}: Cloudflare detected
• Response {response.status_code}: Cloudflare detected

AI-assisted analysis of xtekky/gpt4free@973504e177 (2026-08-14). Data as JSON: /api/errors/a116c4b9bf2da15b. Report an issue: GitHub.