[Feature]: Add xAI (Grok) account sign-in via OAuth Device Code for headless hubs #8554

Area

Authentication and account pool

What are you trying to accomplish?

Add xAI (Grok) account authorization via the OAuth 2.0 Device Authorization Grant (RFC 8628, "Device Code") to OpenCodex, so an operator can connect a Grok/xAI account to a headless or remote hub (no local browser, no callback URL to paste) by entering a short code on any other device.

What prevents this today?

The xAI provider only offers the browser-redirect OAuth flow. On a headless or remote hub (for example a k3s pod or an SSH-only server) the redirect target is not reachable from the operator's browser, so the account cannot be added through the dashboard or ocx without workarounds. The same limitation was already raised for ChatGPT/Codex in #3366 and for Codex-only device-code auth in #8082; Grok has no equivalent path.

What should OpenCodex do?

• Provider xai (account pool) offers a "Sign in with device code" action next to the existing OAuth action.
• The proxy requests a device code from the xAI authorization endpoint and shows:
  • verification_uri (and verification_uri_complete when provided),
  • user_code,
  • expires_in countdown.
• The proxy polls the token endpoint at the advertised interval, honours slow_down by increasing the interval, and stops on expired_token / access_denied with a clear message.
• On success the tokens are stored in the account pool exactly like the existing xAI OAuth accounts (same refresh, same expiry handling, same ocx account list visibility).
• The same flow is available from the CLI for headless hubs, with the code and URL printed to stdout and no callback port required.
• Failure and cancellation leave no partial account in the pool.

Example usage or interface

# Headless hub, no browser on the host
ocx account add --provider xai --device-code
# Expected output (example):
#   Open https://accounts.x.ai/device and enter code: ABCD-EFGH (expires in 600s)
#   Waiting for authorization...
#   Authorized: account xai-1 added to pool "xai"
ocx account list --provider xai --json

Dashboard: Providers → xAI → Add account → "Sign in with device code" shows the URL and code and updates its status until authorized.

Alternatives or workarounds

• Run the browser OAuth flow on a laptop and copy the stored credential file to the hub. This is manual, bypasses the account-pool bookkeeping, and breaks on token rotation.
• SSH port-forwarding for the OAuth callback port. This is fragile and does not work when the callback host differs from the hub.

Additional context

• Related: [Feature]: ChatGPT/Codex login via OpenAI deviceauth (device code) for headless/remote hubs #3366 (ChatGPT/Codex device code for headless hubs, closed), [Feature]: Configure device-code-only Codex authentication #8082 (device-code-only Codex auth, open), Headless hub: WebUI cannot reauth native main (deviceauth is pool-only) #3898 (headless hub reauth).
• Requested by an operator running OpenCodex on a remote k3s hub.
• Implementation note for maintainers: confirm that xAI's OAuth server advertises the device authorization endpoint in its discovery document before implementing; this request does not assume a specific endpoint URL.

Checks

• I searched existing issues and documentation.
• This request describes a concrete OpenCodex workflow rather than merely naming a desired technology.
• I removed secrets and personal data.