openclaw - 💡(How to fix) Fix xAI OAuth succeeds for X Premium account, but grok-4.3 inference returns 403 subscription/resource error

Bug type

Behavior bug (incorrect output/state without crash)

Summary

OpenClaw's xAI OAuth flow completes successfully and xai/grok-4.3 is listed as configured with auth, but a live provider probe for xai/grok-4.3 still fails at inference time with HTTP 403:

You have either run out of available resources or do not have an active Grok subscription. Manage your subscription at https://grok.com/?_s=usage or subscribe at https://grok.com/supergrok.

This looks different from existing xAI OAuth login/scope/redirect failures because local OAuth succeeds and the request reaches the xAI Responses transport. The failure appears to be provider-side entitlement/resource recognition for an X Premium subscription account, or a diagnostic gap around that state.

Steps to reproduce

1. Use OpenClaw 2026.5.19-beta.1.
2. Complete xAI browser OAuth for the root/main agent with an account that has an active X Premium subscription.
3. Confirm xAI auth and catalog state with:
   • openclaw models auth list --provider xai
   • openclaw models list --provider xai
4. Probe xAI model auth/inference:
   • openclaw models status --probe --probe-provider xai --probe-timeout 90000

Expected behavior

Per the xAI announcement and current OpenClaw docs, an eligible Grok or X Premium OAuth subscription should allow OpenClaw to use xai/grok-4.3 without requiring a separate XAI_API_KEY.

The probe should succeed or, if the account is not eligible, OpenClaw should surface a clearer diagnostic that distinguishes local OAuth success, account/subscription mismatch, rollout/entitlement propagation delay, quota/resource exhaustion, and unsupported tier.

Actual behavior

Local auth/config state looks valid, but the live probe fails:

[openai-transport] [responses] error provider=xai api=openai-responses model=grok-4.3 status=403 message=403 "You have either run out of available resources or do not have an active Grok subscription. Manage your subscription at https://grok.com/?_s=usage or subscribe at https://grok.com/supergrok."

The same probe output shows:

Default       : deepseek/deepseek-v4-flash
Fallbacks (0) : -
Aliases (1)   : Grok -> xai/grok-4.3
Configured models (4): deepseek/deepseek-v4-pro, deepseek/deepseek-v4-flash, openai/gpt-5.5, xai/grok-4.3
Providers w/ OAuth/tokens (2): openai-codex (1), xai (1)
- xai effective=profiles:~/.openclaw/agents/main/agent/auth-profiles.json | profiles=1 (oauth=1, token=0, api_key=0)
Auth probes: xai/grok-4.3 | xai:<redacted> | auth | 403 available resources / active Grok subscription error

Environment

• OpenClaw: 2026.5.19-beta.1 (ba9034b)
• OS: Ubuntu VPS / systemd Gateway
• Install method: npm global
• Provider/model: xai/grok-4.3
• Auth method: xAI OAuth browser flow
• Subscription: X Premium, started the same day as the test
• Default OpenClaw model remained deepseek/deepseek-v4-flash; xai/grok-4.3 was probed directly and was also temporarily tested as the default before being rolled back.

Local configuration checks

These checks were run before filing:

openclaw config validate
# Config valid: ~/.openclaw/openclaw.json

safe config summary:
{
  "agentsDefaultModel": { "primary": "deepseek/deepseek-v4-flash", "fallbacks": [] },
  "thinkingDefault": "low",
  "xaiModelOverride": { "alias": "Grok" },
  "pluginsAllowContainsXai": true,
  "xaiPluginEntryPresent": true,
  "xaiWebSearchApiKeyPresent": true,
  "xaiWebSearchBaseUrlPresent": false
}

openclaw models list --provider xai
# xai/grok-4.20-beta-latest-non-reasoning  auth yes
# xai/grok-4.20-beta-latest-reasoning      auth yes
# xai/grok-4.3                             auth yes configured,alias:Grok

There is an xAI web-search API key in plugin config, but models status --probe --probe-provider xai reports xai effective=profiles:... and probes the OAuth profile, so the web-search key does not appear to be the failing model auth path.

Related issues / PRs checked

This appears adjacent to but distinct from:

• #83960 — xAI OAuth unknown scope during login
• #84018 — xAI OAuth refresh blocked by Cloudflare
• #83425 — xAI OAuth redirect URI mismatch
• #84379 — api:access scope rejected, closed as duplicate of #83960
• #84350 — docs clarify xAI OAuth setup for SuperGrok or X Premium subscriptions

Additional information

This could be X Premium entitlement propagation delay immediately after a new subscription, OAuth account mismatch between the authenticated xAI account and the subscribed X account, xAI rollout/entitlement gating not recognizing some X Premium accounts, or an OpenClaw-side auth/provider diagnostic gap.

Even if the root cause is provider-side entitlement, OpenClaw could likely improve diagnostics by recognizing the 'OAuth succeeded but inference entitlement failed' state and suggesting account/tier/propagation checks rather than presenting it as a generic missing subscription/resource error.