Skip to main content
Mibyan supports MiniMax through a browser-based OAuth login flow, using the same credentials as the MiniMax portal. No API key or credit card is required — log in once and Mibyan automatically refreshes your session. The transport reuses the anthropic_messages adapter (MiniMax exposes an Anthropic Messages-compatible endpoint at /anthropic), so all existing tool-calling, streaming, and context features work without any adapter changes.

​
Overview

​
Prerequisites

  • Python 3.9+
  • Mibyan installed
  • A MiniMax account at minimax.io (global) or minimaxi.com (China)
  • A browser available on the local machine (or use --no-browser for remote sessions)

​
Quick Start

After the first login, credentials are stored under ~/.mibyan/auth.json and are refreshed automatically before each session.

​
Logging In Manually

You can trigger a login without going through the model picker:

​
China region

If your account is on the China platform (minimaxi.com), use the API-key-based minimax-cn provider instead — minimax-cn is registered with auth_type="api_key" only (no OAuth flow). Configure MINIMAX_CN_API_KEY (and optionally MINIMAX_CN_BASE_URL) directly:

​
Remote / headless sessions

On servers or containers where no browser is available:
Mibyan will print the verification URL and user code — open the URL on any device and enter the code when prompted.

​
The OAuth Flow

Mibyan implements a PKCE browser OAuth flow against the MiniMax OAuth endpoints:
  1. Mibyan generates a PKCE verifier / challenge pair and a random state value.
  2. It POSTs to {base_url}/oauth/code with the challenge and receives a user_code and verification_uri.
  3. Your browser opens verification_uri. If prompted, enter the user_code.
  4. Mibyan polls {base_url}/oauth/token until the token arrives (or the deadline passes).
  5. Tokens (access_token, refresh_token, expiry) are saved to ~/.mibyan/auth.json under the minimax-oauth key.
Token refresh (standard OAuth refresh_token grant) runs automatically at each session start when the access token is within 60 seconds of expiry.

​
Checking Login Status

The ◆ Auth Providers section will show:
or, if not logged in:

​
Switching Models

Or set the model directly:

​
Configuration Reference

After login, ~/.mibyan/config.yaml will contain entries similar to:

​
Region endpoints

​
Provider aliases

All of the following resolve to minimax-oauth:

​
Environment Variables

The minimax-oauth provider does not use MINIMAX_API_KEY or MINIMAX_BASE_URL. Those variables are for the API-key-based minimax and minimax-cn providers only. To use minimax-oauth as the active provider, set model.provider: minimax-oauth in config.yaml (use mibyan setup for the guided flow), or pass --provider minimax-oauth for a single invocation:

​
Models

Both models support up to 200,000 tokens of context. MiniMax-M2.7 is also used automatically as the auxiliary model for vision and delegation tasks when minimax-oauth is the primary provider.

​
Troubleshooting

​
Token expired — not re-logging in automatically

Mibyan refreshes the token on every session start if it is within 60 seconds of expiry. If the access token is already expired (for example, after a long offline period), the refresh happens automatically on the next request. If refresh fails with refresh_token_reused or invalid_grant, Mibyan marks the session as requiring re-login. When the refresh failure is terminal (HTTP 4xx, invalid_grant, revoked grant, etc.), Mibyan marks the refresh token as dead and quarantines it locally so it doesn’t keep replaying the doomed exchange. The agent surfaces a single “re-authentication required” message and stays out of the way until you log in again. Fix: run mibyan auth add minimax-oauth again to start a fresh login. The quarantine clears on the next successful exchange.

​
Authorization timed out

The device-code flow has a finite expiry window. If you don’t approve the login in time, Mibyan raises a timeout error. Fix: re-run mibyan auth add minimax-oauth (or mibyan model). The flow starts fresh.

​
State mismatch (possible CSRF)

Mibyan detected that the state value returned by the authorization server does not match what it sent. Fix: re-run the login. If it persists, check for a proxy or redirect that is modifying the OAuth response.

​
Logging in from a remote server

If mibyan cannot open a browser window, use --no-browser:
Mibyan prints the URL and code. Open the URL on any device and complete the flow there.

​
”Not logged into MiniMax OAuth” error at runtime

The auth store has no credentials for minimax-oauth. You have not logged in yet, or the credential file was deleted. Fix: run mibyan model and select MiniMax (OAuth), or run mibyan auth add minimax-oauth.

​
”Provider ‘minimax-oauth’ is set in config.yaml but no credentials were found”

The main agent or an auxiliary task (compression, vision, …) is pinned to minimax-oauth and the auth store has no login. There is no MINIMAX_API_KEY-style environment variable for the OAuth provider — MINIMAX_API_KEY belongs to the plain API-key minimax provider. Fix: run mibyan auth add minimax-oauth to sign in, or switch that provider to minimax with an API key.

​
Logging Out

To remove stored MiniMax OAuth credentials:

​
See Also