openclaw - 💡(How to fix) Fix xAI OAuth fails: `api:access` scope rejected by xAI server ("Unknown scope: ap") [1 comments, 2 participants]

Summary

openclaw models auth login --provider xai (and openclaw onboard --auth-choice xai-oauth) fails at the browser authorization step on 2026.5.18 and 2026.5.19-beta.1. xAI's auth server rejects the requested scope list with:

Failed to generate authentication code — Unknown scope: ap

Reproduction

1. Install [email protected] (or @2026.5.19-beta.1)
2. Have an active xAI/Grok Premium+ subscription on the X account you'll authorize with
3. Run:

   openclaw models auth login --provider xai

4. CLI generates an authorize URL pointing at https://auth.x.ai/oauth2/authorize?...&scope=openid+profile+email+offline_access+grok-cli%3Aaccess+api%3Aaccess&...
5. Open URL in browser, sign in with X account
6. xAI rejects with "Failed to generate authentication code — Unknown scope: ap"

(The "ap" in the error appears to be xAI's server truncating the offending scope name in its message — full rejected scope is almost certainly api:access.)

Root cause hypothesis

dist/xai-oauth-*.js (line 14) hardcodes:

const XAI_OAUTH_SCOPE = "openid profile email offline_access grok-cli:access api:access";

Same string in both 2026.5.18 and 2026.5.19-beta.1. Likely xAI renamed, split, or deprecated api:access on their side after the plugin was published. Need to confirm the current accepted scope list against xAI's published OAuth discovery doc and update the constant.

Workarounds attempted (all fail same way)

• --device-code flag → "Unknown auth method" (CLI rejects flag for xai provider)
• --method xai-oauth / --method oauth / --method oauth-premium → "Unknown auth method"
• Bare interactive flow → reaches browser, then same scope rejection

Impact

Premium+ subscribers cannot use their existing entitlement as an OAuth fallback in OpenClaw. The only working xAI auth path remaining is xai-api-key, which is pay-as-you-go and defeats the purpose of the X Premium / OpenClaw bridge announced by @xai.

Environment

• OpenClaw: 2026.5.18 (50a2481), also reproduced against 2026.5.19-beta.1
• OS: Ubuntu 24.04, Linux 6.14.0-1018-aws
• Account: fresh xAI Premium+ (never previously authorized to OpenClaw)

Suggested fix

1. Pull the current accepted scope list from https://auth.x.ai/.well-known/oauth-authorization-server (or whatever xAI publishes)
2. Update XAI_OAUTH_SCOPE to match
3. Consider fetching scope list dynamically rather than hardcoding, so future xAI changes don't silently break the plugin