Refreshing an access token using sso refresh token (Not working?) #503

TeslaOwnerTips · 2021-12-25T03:31:48Z

https://auth.tesla.com/oauth2/v3/token
The SSO refresh token I'm using is valid based on it being used by two homebridge plugins and TeslaFi.
It was generated using the AuthforTesla ios app.

The error is

You don't have permission to access "http://auth.tesla.com/oauth2/v3/token" on this server.

I tested what was being received using httpbin running locally in docker.
Note: The key I show below is not an actual key.

"headers": {
"Accept": "/",
"Content-Length": "1341",
"Content-Type": "application/json",
"Host": "192.168.1.11",
"User-Agent": "curl/7.74.0"
},
"json": {
"client_id": "ownerapi",
"grant_type": "refresh_token",
"refresh_token": "eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ilg0RmNua0RCUVBUTnBrZTZiMnNsdgdsgtL29hdXRoMi92MyIsImF1ZCI6Imh0dHBzOi8vYXV0aC50ZXNsYS5jb20vb2F1dGgyL3YzL3Rva2VuIiwiaWF0IjoxNjM1OdfgzdgIjoiMSIsImF1ZCI6Imh0dHBzOi8vb3duZXItYXBpLnRlc2xhbWzdfgzgZWUtOTBhYS02MzUzNWFjMmY2ZDkiLCJzY3AiOlsib3BlbmlkIiwiZW1haWwiLCJvZmZsaW5lX2FjY2VzcyJdLCJhenAiOiJvd25lcmFwaSIsImFtciI6WyJwd2QiXSwiYXV0aF90aW1lIjoxNjM1ODk2ODUwfX0.Q_6IBtXPzRojESWY28mq4tmhzo8q60gHDGn4UnhH32_Pt-2Ejz6d3gCZEQYgokw9D9mbBUEASCdkbUmyRFm3xcvseGigOqPm2diAdu8v4CwRPwtNlRsfWXqawl3M7Sajba8hVwiV2P6Pca_mwNb4U58NXP5VylYnjcOLMwOM2O9dikDxUgH24Zi4UvapDMJq-oIY1p8gD8yLhqVMpw67ckNsq2nGiC3BYL2ZxzVUOzZgQiygjtbNMRuoilFCHMsu4JViLhW_b2Eav3w8V2ZZcu21PvKALzSS0y3g_XFyVu4O1CgQPzxvbzxvTjiWQChU7zdk1eZcTJ-Gy_7g_H7cqPrhy3EG-vhgbqxS_hn_Im1gqR9ln1zuTV_OwPJyZMxvM52_TBmOIGt7aOfKR6kZlzUefbLYCEPcCfqggoX69WUIGQXG1wliaai2bRRfESDcc8OFO03xxOInxQBj6RCA1v-YcN8tO9TDejsSWh6EKk4AUG77iD4A5eNtmcMP-F3vWcwlXYFs3tVtPrCyz3psvmCCFN1KM7Vbgjm9P4in_Yx_hpqm-Ttlluql7bkTjYXt1VT7UUQnGrS6n97de47uXgnXIjrw5WMsLhQq3wOLLjoilBk7GDjao9j2UxtbhI",
"scope": "openid email offline_access"
},
"origin": "172.17.0.1",
"url": "http://192.168.1.11/post"

Note: NOT the actual key.

The command used was

curl -X POST -H 'Content-Type: application/json' -d "{\"grant_type\": \"refresh_token\", \"client_id\": \"ownerapi\", \"refresh_token\": \"eyJhbGciOiJSUzI1NiIsInR5cCI6IkpXVCIsImtpZCI6Ilg0RmNua0RCUVBUTnBrZTZiMnNsdgdsgtL29hdXRoMi92MyIsImF1ZCI6Imh0dHBzOi8vYXV0aC50ZXNsYS5jb20vb2F1dGgyL3YzL3Rva2VuIiwiaWF0IjoxNjM1OdfgzdgIjoiMSIsImF1ZCI6Imh0dHBzOi8vb3duZXItYXBpLnRlc2xhbWzdfgzgZWUtOTBhYS02MzUzNWFjMmY2ZDkiLCJzY3AiOlsib3BlbmlkIiwiZW1haWwiLCJvZmZsaW5lX2FjY2VzcyJdLCJhenAiOiJvd25lcmFwaSIsImFtciI6WyJwd2QiXSwiYXV0aF90aW1lIjoxNjM1ODk2ODUwfX0.Q_6IBtXPzRojESWY28mq4tmhzo8q60gHDGn4UnhH32_Pt-2Ejz6d3gCZEQYgokw9D9mbBUEASCdkbUmyRFm3xcvseGigOqPm2diAdu8v4CwRPwtNlRsfWXqawl3M7Sajba8hVwiV2P6Pca_mwNb4U58NXP5VylYnjcOLMwOM2O9dikDxUgH24Zi4UvapDMJq-oIY1p8gD8yLhqVMpw67ckNsq2nGiC3BYL2ZxzVUOzZgQiygjtbNMRuoilFCHMsu4JViLhW_b2Eav3w8V2ZZcu21PvKALzSS0y3g_XFyVu4O1CgQPzxvbzxvTjiWQChU7zdk1eZcTJ-Gy_7g_H7cqPrhy3EG-vhgbqxS_hn_Im1gqR9ln1zuTV_OwPJyZMxvM52_TBmOIGt7aOfKR6kZlzUefbLYCEPcCfqggoX69WUIGQXG1wliaai2bRRfESDcc8OFO03xxOInxQBj6RCA1v-YcN8tO9TDejsSWh6EKk4AUG77iD4A5eNtmcMP-F3vWcwlXYFs3tVtPrCyz3psvmCCFN1KM7Vbgjm9P4in_Yx_hpqm-Ttlluql7bkTjYXt1VT7UUQnGrS6n97de47uXgnXIjrw5WMsLhQq3wOLLjoilBk7GDjao9j2UxtbhI\", \"scope\": \"openid email offline_access\"}" "http://192.168.1.11/post"

& replaced URL with "https://auth.tesla.com/oauth2/v3/token"

The text was updated successfully, but these errors were encountered:

TeslaOwnerTips · 2021-12-25T03:37:52Z

I did see #431 but that was with regards to auth token and the recaptcha at that stage.

/oauth2/v3/authorize

GaPhi · 2021-12-25T09:52:59Z

I have noticed in the past that an access/refresh tokens pair inked to an account cannot be used by several apps : each refresh procedure invalidated all the other access and (more certainly) refresh tokens. The only solution I have then found (and still using) is to use several accounts (one per application). This works for more than 2 years now. But it limits the number of applications to the maximum number of accounts linked to a car. Le sam. 25 déc. 2021 à 04:38, TeslaOwner.tips ***@***.***> a écrit :

…

I did see #431 <#431> but that was with regards to auth token and the recaptcha at that stage. — Reply to this email directly, view it on GitHub <#503 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ADUNWNIZUJY3VHZW3Q634TDUSU4CBANCNFSM5KXMB5IA> . Triage notifications on the go with GitHub Mobile for iOS <https://apps.apple.com/app/apple-store/id1477376905?ct=notification-email&mt=8&pt=524675> or Android <https://play.google.com/store/apps/details?id=com.github.android&referrer=utm_campaign%3Dnotification-email%26utm_medium%3Demail%26utm_source%3Dgithub>. You are receiving this because you are subscribed to this thread.Message ID: ***@***.***>

BlackPhoenix · 2021-12-25T16:01:01Z

What? No, just create a brand new token, using the same credentials. Each set of token/refresh token will live independently.

TeslaOwnerTips · 2021-12-25T18:45:37Z

Would it not be a security risk if mutliple refresh token were allowed to exist? I guess changing the account password would solve that.

TeslaOwnerTips · 2021-12-25T18:51:26Z

I generated a new SSO Refresh Token using my wife's account. Same error.
I'm using TeslaFi's Chrome plugin to get the sso token.

NikhithVasa · 2021-12-28T03:36:39Z

Can I hit any of the apis listed here https://tesla-api.timdorr.com/miscellaneous/endpoints with the refresh_token and the access_token from the app - https://apps.apple.com/us/app/auth-app-for-tesla/id1552058613? if Yes can someone PLEASE provide me the curl command as the above website doesn't explain what the request params/ how to pass the auth token while hitting the vehicle apis. Any help is really appreciated. Thanks in advance.

TeslaOwnerTips · 2021-12-28T03:54:16Z

@nickjava create a separate issue. Never hijack a thread on github. Don’t add to it by responding. Just do it and don’t add anything irrelevant to this thread even if it is an apology.

simwood-simon · 2022-03-27T14:50:54Z

Same issue here accessing per the docs:

curl -X POST  -A "Powerwall" -H 'Content-Type: application/json' -d '{"grant_type": "refresh_token", "client_id": "ownerapi", "scope": "openid email offline_access", "refresh_token": "my_refresh_token_removed"}' https://auth.tesla.com/oauth2/v3/token

<HTML><HEAD>
<TITLE>Access Denied</TITLE>
</HEAD><BODY>
<H1>Access Denied</H1>

You don't have permission to access "http&#58;&#47;&#47;auth&#46;tesla&#46;com&#47;oauth2&#47;v3&#47;token" on this server.<P>
Reference&#32;&#35;18&#46;97997a5c&#46;1648392267&#46;175f1465
</BODY>
</HTML>

faekz0r · 2022-05-11T21:44:27Z

Same issue here accessing per the docs:

curl -X POST  -A "Powerwall" -H 'Content-Type: application/json' -d '{"grant_type": "refresh_token", "client_id": "ownerapi", "scope": "openid email offline_access", "refresh_token": "my_refresh_token_removed"}' https://auth.tesla.com/oauth2/v3/token

<HTML><HEAD>
<TITLE>Access Denied</TITLE>
</HEAD><BODY>
<H1>Access Denied</H1>

You don't have permission to access "http&#58;&#47;&#47;auth&#46;tesla&#46;com&#47;oauth2&#47;v3&#47;token" on this server.<P>
Reference&#32;&#35;18&#46;97997a5c&#46;1648392267&#46;175f1465
</BODY>
</HTML>

Did you find a solution? Running into the same issue here.

TeslaOwnerTips · 2022-05-12T01:40:46Z

No :(
Using the Tesla Fi api for now. Moved on to other hobbies 😊

simwood-simon · 2022-10-11T09:02:20Z

I didn't, no, sorry

…

On Wed, May 11, 2022 at 22:44:39, faekz0r < ***@***.*** > wrote: > > > Same issue here accessing per the docs: > > curl -X POST -A "Powerwall" -H 'Content-Type: application/json' -d > '{"grant_type": "refresh_token", "client_id": "ownerapi", "scope": "openid > email offline_access", "refresh_token": "my_refresh_token_removed"}' https:/ > / auth. tesla. com/ oauth2/ v3/ token ( > https://auth.tesla.com/oauth2/v3/token ) > > <HTML><HEAD> > <TITLE>Access > Denied</TITLE> > </HEAD><BODY> > <H1>Access Denied</H1> > > You don't have > permission to access > "http://auth.tesla.com/oauth2/v3/token" on > this server.<P> > Reference #18.97997a5c.1648392267.175f1465 > </BODY> > </HTML> > Did you find a solution? Running into the same issue here. — Reply to this email directly, view it on GitHub ( #503 (comment) ) , or unsubscribe ( https://github.com/notifications/unsubscribe-auth/AB7CEDAOIH24VSXJAJHQPOLVJQS4PANCNFSM5KXMB5IA ). You are receiving this because you commented. Message ID: <timdorr/tesla-api/issues/503/1124322326 @ github. com>

TeslaOwnerTips mentioned this issue Dec 25, 2021

Thank you alibad/tesla-api-android#5

Open

timdorr closed this as completed May 21, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Refreshing an access token using sso refresh token (Not working?) #503

Refreshing an access token using sso refresh token (Not working?) #503

TeslaOwnerTips commented Dec 25, 2021 •

edited

Loading

TeslaOwnerTips commented Dec 25, 2021 •

edited

Loading

GaPhi commented Dec 25, 2021 via email

BlackPhoenix commented Dec 25, 2021

TeslaOwnerTips commented Dec 25, 2021

TeslaOwnerTips commented Dec 25, 2021

NikhithVasa commented Dec 28, 2021

TeslaOwnerTips commented Dec 28, 2021 •

edited

Loading

simwood-simon commented Mar 27, 2022

faekz0r commented May 11, 2022

TeslaOwnerTips commented May 12, 2022

simwood-simon commented Oct 11, 2022 via email

Refreshing an access token using sso refresh token (Not working?) #503

Refreshing an access token using sso refresh token (Not working?) #503

Comments

TeslaOwnerTips commented Dec 25, 2021 • edited Loading

TeslaOwnerTips commented Dec 25, 2021 • edited Loading

GaPhi commented Dec 25, 2021 via email

BlackPhoenix commented Dec 25, 2021

TeslaOwnerTips commented Dec 25, 2021

TeslaOwnerTips commented Dec 25, 2021

NikhithVasa commented Dec 28, 2021

TeslaOwnerTips commented Dec 28, 2021 • edited Loading

simwood-simon commented Mar 27, 2022

faekz0r commented May 11, 2022

TeslaOwnerTips commented May 12, 2022

simwood-simon commented Oct 11, 2022 via email

TeslaOwnerTips commented Dec 25, 2021 •

edited

Loading

TeslaOwnerTips commented Dec 25, 2021 •

edited

Loading

TeslaOwnerTips commented Dec 28, 2021 •

edited

Loading