grok-cpa-bootstrap

Run the bundled configure_grok_cpa.py script with the CPA API key supplied via the CPA_API_KEY environment variable. It updates ~/.grok/config.toml and a managed block in ~/.zshenv with mode 600, then verify with 'grok models' in a new login shell.

Use retry_cpa_auth.py against the saved accounts file; it skips accounts that already have xai-*.json auth files and retries only rate limits, network errors, and upstream 5xx responses with cooldowns. Do not rerun registration for accounts that already registered successfully.

The skill targets macOS with Homebrew by default, using brew services for CPA and zsh for shell configuration. Other platforms are only handled when the user explicitly requests them, and the documented commands assume macOS tooling.

That error means the OIDC import succeeded but the specific model lacks upstream credits or subscription entitlement. It is an xAI entitlement failure, not a CPA import failure; test a different model or report the blocked model separately.

JWT_SECRET and ADMIN_PASSWORDS are installed as Worker secrets via wrangler secret bulk, never as plaintext [vars] in wrangler.toml. Secrets are generated fresh per machine, kept in shell variables only, and unset after use.

It means the consent UI completed but xAI rejected the device grant at the token endpoint. The recovery run stops immediately; do not rotate proxies or repeat device grants to bypass the upstream decision.