zeroclaw-labs/zeroclaw · error · anyhow::Error

xAI OAuth discovery failed ({status}): {body}

Error message

xAI OAuth discovery failed ({status}): {body}

What it means

`fetch_discovery` GETs `https://auth.x.ai/.well-known/openid-configuration` and any non-2xx aborts xAI OAuth setup; both `fetch_oauth_discovery` and `fetch_device_code_discovery` route through it. All endpoints xai_oauth.rs uses (authorize, token, device authorization) are discovered from this document, so a discovery failure blocks every xAI flow. The HTTP status and body are embedded in the error.

Source

Thrown at crates/zeroclaw-providers/src/auth/xai_oauth.rs:141

        "token endpoint",
    )?;
    Ok(DeviceCodeDiscovery {
        device_authorization_endpoint,
        token_endpoint,
    })
}

async fn fetch_discovery(client: &Client) -> Result<DiscoveryResponse> {
    let response = client
        .get(XAI_OAUTH_DISCOVERY_URL)
        .header("Accept", "application/json")
        .send()
        .await
        .context("Failed to fetch xAI OAuth discovery")?;
    if !response.status().is_success() {
        let status = response.status();
        let body = response.text().await.unwrap_or_default();
        anyhow::bail!("xAI OAuth discovery failed ({status}): {body}");
    }
    response
        .json()
        .await
        .context("Failed to parse xAI OAuth discovery")
}

pub fn build_authorize_url(authorization_endpoint: &str, pkce: &PkceState) -> String {
    let mut params = BTreeMap::new();
    params.insert("response_type", "code");
    params.insert("client_id", XAI_OAUTH_CLIENT_ID);
    params.insert("redirect_uri", XAI_OAUTH_REDIRECT_URI);
    params.insert("scope", XAI_OAUTH_SCOPE);
    params.insert("state", pkce.state.as_str());
    params.insert("code_challenge", pkce.code_challenge.as_str());
    params.insert("code_challenge_method", "S256");
    params.insert("plan", "generic");
    params.insert("referrer", "zeroclaw");

View on GitHub (pinned to 88bb9c8533)

Solutions

1. Verify reachability directly: `curl -i https://auth.x.ai/.well-known/openid-configuration`
2. Retry with backoff for 5xx/429; check xAI status channels for incidents
3. Fix proxy/firewall exemptions so auth.x.ai answers with the JSON document
4. If discovery stays broken, authenticate another way (e.g. `import_grok_auth_profile` from an existing Grok auth file)

let resp = reqwest::get("https://auth.x.ai/.well-known/openid-configuration").await?;
if !resp.status().is_success() {
    // defer the OAuth flow and surface a connectivity hint instead of a raw error
}

match fetch_oauth_discovery(&client).await {
    Ok(d) => d,
    Err(e) if e.to_string().contains("discovery failed") && is_transient(&e) => {
        retry_with_backoff(fetch_oauth_discovery(&client)).await?
    }
    Err(e) => return Err(e),
}

When it happens

Trigger: xAI auth outage or maintenance returning 5xx; 429 rate limiting; a firewall, proxy, or captive portal blocking or rewriting auth.x.ai; DNS misresolution.

Common situations: CI runners without x.ai reachability; corporate TLS-inspecting proxies; transient provider incidents.

Related errors

• xAI device-code start failed ({status}): {body}
• xAI device-code polling failed ({status}): {}
• xAI device-code polling failed ({status}): {text}
• xAI OAuth token request failed ({status}): {}
• xAI OAuth token request failed ({status}): {body}

AI-assisted analysis of zeroclaw-labs/zeroclaw@88bb9c8533 (2026-08-23). Data as JSON: /api/errors/f89c199aff5d0344. Report an issue: GitHub.