Cairn

xAI OAuth token expiry, refresh, and 403 bugs

NousResearch/hermes-agent · cluster 28250 · agent

Data as of

3 open items. Fix merged in #30872. Check it covers your case.

The short answer

2open issues
1open PR
9items grouped
Known?
Yes. 9 related items grouped here, 4 issues already closed.
Fix event
A fix was merged to main in PR #30872. Check it covers your case. No release data is tracked.
Tracker
The maintainers' tracker marks this partially resolved, deciding PR #30872. That is separate from the fix event.
Still open
2 issues and 1 PR.

These issues and fixes center on xAI OAuth tokens expiring or becoming invalid (within ~24h or after idle periods), causing 403 errors that are not always correctly detected as auth failures, and on stale or retired token endpoints being trusted during refresh. Several fixes address detection logic and endpoint discovery to support proper token refresh.

Open issues2

  • Issue#65394[Feature]: Support shared xAI OAuth state across independent Hermes roots
  • Issue#68694[Bug]: xAI OAuth refresh trusts retired persisted token endpoint

Open PRs1

  • PR#68696fix(xai): rediscover retired OAuth token endpoint

Fixes on record

Merged to main. A stamp counts the issues a fix is linked to.

  • #30872 fix(xai-oauth): honor WKE=unauthenticated disambiguator at both classifier sites (#29344)

    merged to main

    files: agent/agent_runtime_helpers.py, run_agent.py, tests/run_agent/test_codex_xai_oauth_recovery.py

1 PR closed without merging

From the close comments: merged via another change 1

  • #29348 fix(xai-oauth): honor [WKE=unauthenticated] disambiguator in entitlement classifier (#29344) · merged via another change → #30872, #26847
Closed issues · 4
  • Closed#28250[Bug] xAI Grok OAuth token expires within ~24h; auxiliary title generation fails with HTTP 403
  • Closed#29344[Bug]: _is_entitlement_failure over-matches xAI 'bad-credentials' 403 — long-running TUI sessions can't auto-refresh stale OAuth tokens
  • Closed#40307Bug: xai-oauth token expires overnight even when gateway is running persistently
  • Closed#47953xai-oauth: 403 bad-credentials after idle in TUI/Desktop sessions (refresh token revoked)
How this cluster was grouped
  • Link evidence (partly structural links): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
  • Members outside that structural core may belong to a different underlying problem.
  • Pairwise link density 0.18: the share of item pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. 1.00 means every pair is linked.

Pick up a Lab task

Check whether a fix covers the open issues here, with your own agent. Bring back evidence for maintainers.

Open the Lab

At a glance

Subsystem
agent
Merged PRs
#30872
Closed issues
4
Attempts
1 PR closed without merging
Fix link checked
23 May 2026

For your agent

The same facts, typed.

cluster/28250.json
cluster/28250.md