# NousResearch/hermes-agent · xAI OAuth token expiry, refresh, and 403 bugs

## Open now

- 2 issues, 1 PR open on GitHub.
- #65394: \[Feature\]: Support shared xAI OAuth state across independent Hermes roots
- #68694: \[Bug\]: xAI OAuth refresh trusts retired persisted token endpoint
- PR #68696: fix(xai): rediscover retired OAuth token endpoint

These issues and fixes center on xAI OAuth tokens expiring or becoming invalid (within ~24h or after idle periods), causing 403 errors that are not always correctly detected as auth failures, and on stale or retired token endpoints being trusted during refresh. Several fixes address detection logic and endpoint discovery to support proper token refresh.

## TL;DR

- 9 member(s): 2 open issue(s), 4 closed issue(s), 1 open PR(s), 1 merged PR(s), 1 PR(s) closed without merging.
- A fix was merged to main in PR #30872. Verify it addresses your case.
- **Recommended:** read PR #30872 (and any competing PRs below) before filing. Confirm the merged change covers your symptom.

## Maintainer resolution verdict

- Internal-tracker verdict over this cluster's issue members: `partially_resolved` · deciding PR(s): `pr-30872`. This is distinct from the fix status above. Weigh it yourself.

## How this cluster was grouped

- Link evidence (`STRUCTURAL_PARTIAL`): some members are connected by structural evidence (shared changed files, or a closing/superseded reference); the rest are joined by an automated relevance judgement over their text.
- Members outside that structural core may belong to a different underlying problem.
- Pairwise link density `0.18`: the share of member pairs that carry a link, counting a structural link in full and a relevance-only link at 0.36. `1.00` means every pair is linked.

## Open related issues

- #65394: \[Feature\]: Support shared xAI OAuth state across independent Hermes roots
- #68694: \[Bug\]: xAI OAuth refresh trusts retired persisted token endpoint

## Closed / duplicate issues

- #28250: \[Bug\] xAI Grok OAuth token expires within ~24h; auxiliary title generation fails with HTTP 403
- #29344: \[Bug\]: _is_entitlement_failure over-matches xAI 'bad-credentials' 403 — long-running TUI sessions can't auto-refresh stale OAuth tokens
- #40307: Bug: xai-oauth token expires overnight even when gateway is running persistently
- #47953: xai-oauth: 403 bad-credentials after idle in TUI/Desktop sessions (refresh token revoked)

## Prior & competing PRs

- **#30872: fix(xai-oauth): honor WKE=unauthenticated disambiguator at both classifier sites (#29344)**. merged to main · fix tier `verified`
  - maintainer direction: category `merged`; implication `superseded`
  - files: `agent/agent_runtime_helpers.py`, `run_agent.py`, `tests/run_agent/test_codex_xai_oauth_recovery.py`
- **#29348: fix(xai-oauth): honor \[WKE=unauthenticated\] disambiguator in entitlement classifier (#29344)**. closed without merge
  - maintainer direction: category `merged_via`; implication `superseded`; refs `#30872`, `#26847`, `#26847`
- **#68696: fix(xai): rediscover retired OAuth token endpoint**. open
  - maintainer direction: category `partial_fix`; implication `needs_llm`; refs `84fbb15d4981`, `#68694`, `#68696`, `#68696`, `#68696`, `#374151`, `#68694`, `#68696`
  - files: `hermes_cli/auth.py`, `tests/hermes_cli/test_auth_xai_oauth_provider.py`

## Fix status

- Merged to main in PR #30872 (cited above). No release data is tracked. Verify downstream.
- Fix last verified (merged) `2026-05-23`.
- Subsystem: `agent`