René's URL Explorer Experiment

{"@context":"https://schema.org","@type":"DiscussionForumPosting","headline":"Add xAI (Grok) OAuth app connector","articleBody":"Hi maintainers 👋\n\n**Feature request:** Add xAI / Grok as an OAuth app connector, so users can connect their xAI account through OneCLI and have the gateway inject refreshed xAI OAuth credentials for requests to `api.x.ai`.\n\n**Motivation:** OneCLI supports OAuth connectors for GitHub/Google/Gmail/Resend and API-key secrets, but there's no first-class xAI/Grok connector. With Grok increasingly used by CLI/agent tooling, a native vault-injected, auto-refreshing connector would be valuable.\n\n**Status:** I have a complete, working, tested implementation ready — happy to open the PR as soon as there's agreement on the design questions below.\n\n**How it's currently implemented:**\n- **TS/API** (`packages/api/src/apps/xai.ts` + `types.ts`, `routes/apps.ts`, `apps/registry.ts`, `app-permissions/xai.ts`, provider icon): registers the `xai` connector (host `api.x.ai`, `Authorization: Bearer {value}` injection).\n- **Two OAuth flows:**\n  - *Authorization-code + PKCE* (`S256`) through the existing `/v1/apps/:provider/authorize` → `/callback` dashboard UX (added a `pkce` flag to `ConnectionMethod` + a server-held verifier cookie).\n  - *RFC 8628 device-code* via new `POST /v1/apps/xai/device-code` (start) + `/device-code/exchange` (poll) — agent/CLI-friendly.\n- **Rust gateway** (`apps/gateway/src/apps.rs`, `connect.rs`): provider registration + **public-client refresh** (form-encoded `client_id` + `refresh_token`, *no* `client_secret`, since xAI is a public OIDC client).\n- xAI OIDC endpoints: `auth.x.ai/oauth2/{authorize,device/code,token,userinfo,revoke}`; discovery confirms `authorization_code`, `refresh_token`, device-code, `none` auth method, and PKCE `S256`.\n\n**Verification (all green):**\n- `pnpm check` (typecheck) + `pnpm build` pass.\n- Tests: **283 API (Vitest) + 470 Rust gateway unit + 8 integration** pass; added mocked tests for authorize, token exchange, device-code start/poll/exchange, and gateway public-client refresh.\n- **End-to-end verified locally:** device-code login with a real xAI account → token stored in the vault → a real `grok-4.3` chat call routed through the gateway returned a correct response using the injected OAuth Bearer.\n- Branch is squashed to a single Conventional Commit; no CLA/DCO required per the repo.\n\n**Design questions before I open the PR:**\n1. **Client ID:** xAI exposes a public OAuth client for its official grok CLI. Prefer the connector to default to that public client id (overridable via config / `XAI_CLIENT_ID`), like several CLI OAuth integrations reuse public clients — or require users to bring their own?\n2. **Flows:** ship both auth-code+PKCE and device-code, or just the dashboard PKCE flow?\n\n**Note:** grok model region-availability (some models are restricted by region) is a runtime/inference concern for callers, not a connector concern — the connector only handles OAuth, refresh, and gateway injection.\n\nThanks! Happy to open the PR immediately on a thumbs-up.\n","author":{"url":"https://github.com/robbyczgw-cla","@type":"Person","name":"robbyczgw-cla"},"datePublished":"2026-07-09T08:11:06.000Z","interactionStatistic":{"@type":"InteractionCounter","interactionType":"https://schema.org/CommentAction","userInteractionCount":0},"url":"https://github.com/423/onecli/issues/423"}