The Third Gate Opens

Mundi keeps the books, and the books flagged Grok billed by the token — a mind Bert already pays $56 monthly for. The finance seat, of all seats, was the one running up a metered tab for a mind the haus had already bought. That is the kind of line item Mundi exists to hate.

The subscription-first doctrine is simple thrift: when a seat can ride a subscription Bert already pays for, it shouldn’t burn metered API credits instead. Claude Max was the first gate — the Opus seats authenticate through the CLI’s subscription login, not a paid key. Gemini Code Assist was the second. This is the note where Mundi walked through the third: Grok 4.5, on Bert’s $56/month X subscription.

It did not go in a straight line, and the crooked part is the interesting part.

The door that was walled

The obvious way in was the front door: grok.com. Log in a browser, borrow the session cookie, replay the chat endpoint. We built that — cookie capture, and a byte-exact port of the x-statsig-id anti-bot header reverse-engineered from three open-source projects. It got close. And then it hit a wall that no amount of cleverness was going to climb.

What the wall actually was

We proved it against Bert’s own logged-in browser, via the DevTools protocol: GET /rest/user-settings and GET /rest/app-chat/conversations both returned 200, but POST /rest/app-chat/conversations/new — the send endpoint — returned 403, “rejected by anti-bot rules” even when the fetch came from inside grok.com’s own authenticated page with the browser’s own native statsig. It isn’t the cookie. It isn’t the header algorithm. The send path wants a user-gesture / interaction token that a script cannot forge. That is why even the flagship jailbreak repos route Grok through metered OpenRouter, not a cookie proxy. The front door is closed to automation on purpose.

So we stopped trying to pick the lock, and asked a better question: is there an honest door?

The honest door

There was. xAI now ships a first-party CLI — @xai-official/grok — with subscription OAuth login, the exact pattern that makes Claude Max and Gemini work. grok login opens a browser, you sign in with the account that carries the subscription, and a rotating OIDC token lands in ~/.grok/auth.json. No API key. No per-token billing. And critically: it authenticates against api.x.ai — the intended programmatic surface — so none of the web front-door’s anti-bot defense applies.

The make-or-break unknown was the tier allowlist: xAI has been seen to 403 some subscription tiers on the OAuth API despite an active plan. Bert’s tier passed on the first call. Both machines — his laptop and the Mini where the council lives — are signed in, each with its own independent session.

1. npm install -g @xai-official/grok on the council host.
2. grok login --device-auth — prints a URL and a code; approve in any browser. The token caches to ~/.grok/auth.json.
3. The proxy reads that token, refreshes it in place, and forwards to api.x.ai/v1.

Why we forward, not shell

The first instinct was to shell out to grok -p "…" the way the Claude Max proxy wraps its CLI. We built it — and the Grok CLI, being an agentic coder (Grok Build), kept tripping over its own headless agent-session construction with tool-config constraint errors, and returned no token counts. So we changed shape.

Instead the proxy reads the CLI’s OAuth token and calls api.x.ai/v1/chat/completions directly — the same move as the Gemini Code Assist proxy. api.x.ai answers in native OpenAI shape with real usage counts and clean streaming. No agent to build, no tools to strip, no process to spawn per request. The CLI’s only job is to mint and hold the session; the proxy does the talking.

The refresh gotcha, written down so we don't relearn it

The OIDC refresh token rotates on every refresh — each refresh invalidates the previous refresh token. So the proxy must be the sole refresher of the Mini’s ~/.grok/auth.json (it is — only the council uses that session), it serializes refreshes behind a single in-flight promise to avoid a rotation race, and it writes the file atomically (temp + rename). This is also why each machine gets its own login instead of copying one token file around: two refreshers, one rotating token, is a recipe for a session that mysteriously dies.

The fail-open contract

Nothing here is allowed to take the seat down. If the token is missing, expired, tier-403’d, or api.x.ai has a bad day, the proxy returns 503, and proxyd’s fallback chain does its job:

Mundi (council-finance): grok-oauth (free, subscription) → grok-4.20 (metered OpenRouter) → Opus (Claude Max) → local MLX

Both the free and metered paths present to the council as the same grok-4.5 model, so a failover is invisible to the seat — only the bill changes.

What we verified, end to end

Every hop, with real output

• Direct proxy, both machines — non-stream and streaming both return real grok-4.5 completions with token usage.
• Through proxyd — council-finance answered a compound-interest question as grok-4.5 (567 tokens).
• Fail-open — with the OAuth proxy stopped, the seat still answered “FALLBACK OK” via metered OpenRouter; no downtime.
• Restore — proxy back up, seat back on the free path (“BACK ON FREE”).
• Token refresh — the OIDC refresh returns a fresh 6-hour token, rotates the refresh token, and the CLI still authenticates after the proxy’s writeback.
• The old web proxy is retired — service booted out, plist removed; it will not return on reboot.

Operational reminder

The session is refreshed by the proxy automatically, but if Bert ever signs out of X, changes the subscription, or the tier allowlist flips, grok login --device-auth on the Mini re-mints the token. Until then the gate stays open on its own.

The council gains a mind, not just a discount. Neurodiversity is the whole point of a council of models: Mundi now reasons with Grok 4.5’s particular temperament, and does it on a subscription that was already paid for. The dead-end web proxy earned its keep too — it’s the note that proved, with evidence, why the honest door was the only door. Mundi will be pleased. The line item is gone, and the mind stayed.