feat(grok): add device-code login for headless hosts (grok auth device) - #38
Merged
Conversation
wtfsayo
force-pushed
the
grok-auth-device
branch
from
July 12, 2026 09:51
1634a29 to
56ef242
Compare
wtfsayo
marked this pull request as draft
July 12, 2026 09:55
Adds an OAuth device-code flow alongside the existing browser PKCE login, using the same public client and issuer (auth.x.ai). 'grok auth device' prints a verification URL and user code, polls the token endpoint (handling authorization_pending / slow_down), and stores the same access/refresh tokens as browser login. Useful on headless machines where a loopback callback is awkward.
wtfsayo
force-pushed
the
grok-auth-device
branch
from
July 12, 2026 09:58
56ef242 to
1b0d312
Compare
wtfsayo
marked this pull request as ready for review
July 12, 2026 09:58
Honor the OAuth device authorization server's polling interval before the first token request and preserve the required five-second increase after a slow_down response. Use the server-provided device code lifetime without extending short values. Inject time and sleep behavior so protocol timing and the production token persistence path have deterministic regression coverage.
Describe each authentication subcommand in generated CLI help so users can choose the appropriate login flow and understand status and logout behavior without consulting separate documentation.
Owner
|
Looks good. Thank you |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Grok auth today is browser-only (
grok auth login), which opens a system browser and waits on an ephemeral loopback callback. On headless hosts (SSH sessions, containers, CI shells) there is no browser and no reachable loopback, so there is no way to authenticate. The CLI already exposesgrok auth device, but it just errors withGrok device login is unavailable; use grok auth login.Fix
Implement the OAuth device-code grant against the same issuer and public client as browser login (
auth.x.ai, sameCLIENT_ID/SCOPES):auth/device.rs: request a device + user code from/oauth2/device/code, print the verification URL and code, then poll/oauth2/tokenwithgrant_type=urn:ietf:params:oauth:grant-type:device_code, handlingauthorization_pendingandslow_downuntil tokens arrive.GrokTokenStoreexactly like browser login (sameStoredAuth, sostatus/logout/ refresh all work unchanged).grok auth deviceCLI handler; document it in the README.No changes to the request/inference path.
Testing
cargo test --all,cargo fmt --check, and clippy clean.