openclaw - 💡(How to fix) Fix xAI OAuth: refresh token blocked by Cloudflare, no automated token renewal possible [1 comments, 2 participants]

Problem

xAI OAuth tokens expire every ~6 hours, and the refresh token cannot be used to automatically renew because Cloudflare blocks all automated requests to the xAI token endpoint.

Environment

• OS: Windows
• OpenClaw: 2026.5.19-beta.1
• xAI account: SuperGrok subscriber (web-only membership)

What was done

1. Authenticated via openclaw models auth login --provider xai (OAuth PKCE flow)
2. Token saved with offline_access scope and efresh_token in auth-profiles.json
3. Token expired after ~6 hours (2026-05-18T22:46 UTC)

Observed behavior

Token refresh blocked by Cloudflare

When OpenClaw attempts to use the refresh token to get a new access token, the request to https://auth.x.ai/oauth/token is blocked by Cloudflare with CAPTCHA challenge:

Attention Required! | Cloudflare You are unable to access x.ai

This means automated refresh is impossible — every 6 hours the user must manually re-authenticate via browser.

Token expiration

• Token: xai:[email protected] [xai/oauth; expires 2026-05-18T22:46:23.273Z]
• Refresh token: present in auth-profiles.json (verified)
• Automatic refresh: fails due to Cloudflare blocking

Root cause

Cloudflare's anti-bot protection prevents programmatic use of refresh tokens against uth.x.ai. This is a known Cloudflare behavior for OAuth token endpoints.

Even when the refresh token is valid and the OpenClaw code correctly implements grant_type=refresh_token, the Cloudflare challenge blocks the actual HTTP request before it reaches the OAuth server.

Expected behavior

1. Token refresh should work automatically when access token expires (standard OAuth2 behavior)
2. User should not need to re-authenticate every 6 hours

Current workaround

Manually re-run openclaw models auth login --provider xai when token expires, which requires browser interaction.

Proposed solution

• Explore using the xAI API endpoint (rather than auth.x.ai) for token refresh, if it bypasses Cloudflare
• Document the limitation clearly for SuperGrok (non-API) subscribers
• Consider adding a warning when token is approaching expiry

Tags

provider xai oauth authentication refresh token cloudflare