Unsure how to configure oauth, this path wants to post callback on 127.0.0.1 but hermes is remote machine.
#Help configuring via ssh xAI + Grok OAuth
surreal rune
Ah, looks like this https://hermes-agent.nousresearch.com/docs/guides/xai-grok-oauth#remote--headless-sessions
analog burrow
seems right. you all good?
surreal rune
No that doesn't seem to work either. Time to dig in deeper.
analog burrow
oh fun! if you want me to look into anything, send me over some logs. I'll need to see about acquiring an account to test this myself.
surreal rune
What do you I need do to get you the right logs? From what I see in the logs there's nothing regarding this, just error report from cli xAI authorization timed out waiting for the local callback. Following the instruction linked above, presents same flow resulting in Waiting for callback on http://127.0.0.1:56121/callback. xAI side reports Could not establish connection. We couldn't reach your app. Please copy and paste the code below into Grok Build.
analog burrow
https://discord.com/channels/1053877538025386074/1496283715083567256 you can get logs easily with /debug from the interface or hermes debug share from the terminal outside of hermes. it will put them in temporary pastebins that you can link us.
surreal rune
Report https://paste.rs/Q4x9H
agent.log https://paste.rs/Pfj47
gateway.log https://paste.rs/uBmF9
surreal rune
Thanks the assistance. Just checked, no updates. I do have an xAI API key, but using my X account is definitely more economical.
analog burrow
The logs do not show the actual OAuth command, but they do show Hermes is still configured as provider: xai, not xai-oauth, which is what I would expect if the OAuth callback never completed.
The key line is:
Waiting for callback on http://127.0.0.1:56121/callback
That listener is running on the remote SSH machine. If you open the xAI authorization URL in a browser on your laptop without a tunnel, the browser tries to reach 127.0.0.1:56121 on your laptop instead of the remote machine, and xAI reports that it cannot reach the app.
Keep an SSH tunnel open for the callback port, using the same port Hermes prints:
ssh -N -L 56121:127.0.0.1:56121 user@remote-host
Then, in another SSH session on the remote machine, run the auth flow:
hermes auth add xai-oauth --no-browser
Open the printed authorization URL in your local browser while the tunnel is still running. After the callback succeeds, Hermes should save the tokens and update the provider to xai-oauth.
One extra detail from your logs: the gateway is running with /root/.hermes, so make sure you run the auth command under the same user/profile that your Hermes service uses. If you authenticate as a different Linux user, the tokens can land in a different ~/.hermes/auth.json.
If it still times out with the tunnel active, paste the terminal output from hermes auth add xai-oauth --no-browser after redacting anything sensitive. The /debug share is not currently capturing enough of this CLI-only OAuth attempt to diagnose the callback step by itself.
surreal rune
Got another monkey wrench, I access Hermes through a jump box. Will take me a bit to adapt what you've posted, but can probably get that working.
analog burrow
fun. lmk. if that works, we might need to do a write-up for people in similar setups.
cc @old timber do we have instructions in place for non-local installs? I feel a wave of oauth issues coming from people with remote setups.
old timber
Lets see what we can do here
old timber
@surreal rune @analog burrow https://github.com/NousResearch/hermes-agent/pull/26592
new docs to help configure remote coming
analog burrow
new docs to help configure remote coming
hm.. seems to take a while after merge to hit public docs. not seeing it there yet.
analog burrow
ah, yeah makes sense.
analog burrow
Got another monkey wrench, I access Hermes through a jump box. Will take me a bi...
let me know once you're good on that and have no other questions and I'll close out the thread.
surreal rune
Thanks again. Won't be till later tonight, about +8hrs from now.
analog burrow
Thanks again. Won't be till later tonight, about +8hrs from now.
Ah ok. In that case, I'll close this out for now. Reach back out in a new thread if you have trouble with the SSH tunnel and getting it going. Thanks!