# xAI OAuth PKCE Flow

Complete constants and flow for xAI (Grok) OAuth auto-registration. Mirrors 9router's implementation.

## Constants

```python
XAI_CLIENT_ID = "b1a00492-073a-47ea-816f-4c329264a828"
XAI_ISSUER = "https://auth.x.ai"
XAI_SCOPE = "openid profile email offline_access grok-cli:access api:access"
XAI_LOOPBACK_PORT = 56121
XAI_CALLBACK_PATH = "/callback"
XAI_REDIRECT_URI = f"http://127.0.0.1:{XAI_LOOPBACK_PORT}{XAI_CALLBACK_PATH}"
XAI_PKCE_VERIFIER_BYTES = 96
XAI_API_BASE = "https://api.x.ai/v1"
XAI_USER_AGENT = "grok-cli/9router"
```

## OIDC Discovery

```
GET https://auth.x.ai/.well-known/openid-configuration
→ authorization_endpoint, token_endpoint
Static fallbacks:
  authorize: https://auth.x.ai/oauth2/authorize
  token: [REDACTED]
```

## OAuth Flow

### 1. PKCE Setup

```python
verifier = base64url(secrets.token_bytes(96))  # 96 bytes, no padding
challenge = base64url(sha256(verifier.encode()))
state = secrets.token_urlsafe(32)
```

### 2. Authorization URL

```
GET {authorize_url}?
  response_type=code
  client_id=b1a00492-073a-47ea-816f-4c329264a828
  redirect_uri=http://127.0.0.1:56121/callback
  scope=openid profile email offline_access grok-cli:access api:access
  code_challenge={challenge}
  code_challenge_method=S256
  state={state}
  nonce={hex}
  plan=generic
  referrer=cli-proxy-api
```

### 3. Token Exchange

```python
POST {token_url}
Content-Type: application/x-www-form-urlencoded

grant_type=authorization_code
client_id=b1a00492-073a-47ea-816f-4c329264a828
code={code}
redirect_uri=http://127.0.0.1:56121/callback
code_verifier={verifier}

# Response:
# {"access_token": "xai-...", "refresh_token": "...", "expires_in": 3600, ...}
```

### 4. Token Refresh

```python
POST {token_url}
grant_type=refresh_token
client_id=b1a00492-073a-47ea-816f-4c329264a828
refresh_token={refresh_token}
```

## API Usage

```python
POST https://api.x.ai/v1/chat/completions
Authorization: Bearer {access_token}
Content-Type: application/json
User-Agent: grok-cli/9router

{"model": "grok-4.6", "messages": [{"role": "user", "content": "..."}], "stream": true}
```

## Grok 4.6 Model Details

- Released: August 12, 2026
- Context: 500,000 tokens
- Pricing: $2/$0.50/$6 per 1M tokens (input/cached/output) below 200K
- Reasoning: low, medium, high (default), xhigh
- Modalities: text + image input, text output
- API: Chat Completions + Responses API
- Also available: grok-build-0.1 (coding agent model)

## Gateway Implementation

See `gw46.py` at `C:\Users\User\Documents\grok46gw\gw46.py` for a complete FastAPI gateway:
- Key pool (env vars + SQLite DB + OAuth tokens)
- Round-robin key selection
- OpenAI-compatible /v1/chat/completions and /v1/responses
- OAuth auto-registration web flow at /oauth/register
- Account management at /accounts