Login failed: Captcha required but script says credentials wrong.

[NedAlex94]

I’m running into a login failure that’s misreported by the script. When trying to authenticate, the script reports “invalid login or password,”. But this made no sense, since it had worked the day before.

So I added some debugs in the code, and I got a response from Xiaomi’s server containing "description": "验证码输入错误" and a captchaUrl field. That error means “Captcha input error” in Chinese.

[DEBUG] login_step_2: URL: https://account.xiaomi.com/pass/serviceLoginAuth2

[DEBUG] login_step_2: Fields: {'sid': 'xiaomiio', 'hash': '<redacted>', 'callback': 'https://sts.api.io.mi.com/sts', 'qs': '%3Fsid%3Dxiaomiio%26_json%3Dtrue', 'user': 'XXXXX', '_sign': '0psXfr43eNI0IX6q9Suk3qWbRqU=', '_json': 'true'}

[DEBUG] login_step_2: Response text: &&&START&&&{"qs":"%3Fsid%3Dxiaomiio%26_json%3Dtrue","code":87001,"description":"验证码输入错误","securityStatus":0,"_sign":"0psXfr43eNI0IX6q9Suk3qWbRqU=","sid":"xiaomiio","result":"error","captchaUrl":"/pass/getCode?icodeType=login&0.3094213243055923","callback":"https://sts.api.io.mi.com/sts","location":"","pwd":0,"child":0,"desc":"验证码输入错误"}

[DEBUG] Downloading captcha image from: https://account.xiaomi.com/pass/getCode?icodeType=login&0.3094213243055923

[INFO] Captcha image saved at: C:<redacted>\Local\Temp\tmp5eh0517g.jpg

Enter captcha as shown in the image: <redacted>

So to fix this, I made a function that gets the captcha, and shows it to the user with Pillow, then asks for an input. After that, the script resends the login request with the captcha code included and everything works.

I’ve already patched this in my own code and can submit a pull request if you want. Let me know if you’re interested.

[GNeras]

I am having the same issue, I get a captchaUrl field as well. Could you share your solution? Or could you tell me how to include the captcha code in the request?

[naerschhersch]

same issue here, would love to see an fix for that issue :)

[Korkuttum]

There has been a change in Xiaomi's API regarding the 2FA (Two-Factor Authentication) process. Currently, your code requires users to restart the program when 2FA is needed, but Xiaomi's updated API allows completing the 2FA process without requiring a restart. A retry mechanism can be added to continue the session after 2FA. You can update your code to accommodate this new process.

[NedAlex94]

I am having the same issue, I get a captchaUrl field as well. Could you share your solution? Or could you tell me how to include the captcha code in the request?

I can quickly copy paste my code here but it has not been thoroughly tested. I can only say that it has worked for me.

    def handle_captcha(self, captcha_url: str) -> str:
        import tempfile
        from PIL import Image

        # Full URL in case it s relative
        if captcha_url.startswith("/"):
            captcha_url = "https://account.xiaomi.com" + captcha_url

        print(f"[DEBUG] Downloading captcha image from: {captcha_url}")
        response = self._session.get(captcha_url, stream=True)
        if response.status_code != 200:
            print("[ERROR] Unable to fetch captcha image.")
            return ""

        # Save image to a temporary file
        with tempfile.NamedTemporaryFile(delete=False, suffix=".jpg") as tmp:
            for chunk in response.iter_content(1024):
                tmp.write(chunk)
            tmp_path: str = tmp.name

        print(f"[INFO] Captcha image saved at: {tmp_path}")

        # Open image usig PIL. Should fallback to default image viewer but not tsted
        try:
            img = Image.open(tmp_path)
            img.show()
        except Exception:
            print(f"[INFO] Please open {tmp_path} and solve the captcha.")

        # Ask user for captcha solution
        captcha_solution: str = input("Enter captcha as shown in the image: ").strip()
        return captcha_solution

   def login_step_2(self) -> bool:

        url: str = "https://account.xiaomi.com/pass/serviceLoginAuth2"
        headers: dict = {
            "User-Agent": self._agent,
            "Content-Type": "application/x-www-form-urlencoded"
        }
        fields: dict = {
            "sid": "xiaomiio",
            "hash": hashlib.md5(str.encode(self._password)).hexdigest().upper(),
            "callback": "https://sts.api.io.mi.com/sts",
            "qs": "%3Fsid%3Dxiaomiio%26_json%3Dtrue",
            "user": self._username,
            "_sign": self._sign,
            "_json": "true"
        }
        print(f"[DEBUG] login_step_2: URL: {url}")
        print(f"[DEBUG] login_step_2: Fields: {fields}")

        response = self._session.post(url, headers=headers, params=fields, allow_redirects=False)
        print(f"[DEBUG] login_step_2: Response text: {response.text[:2000]}")

        valid: bool = response is not None and response.status_code == 200

        if valid:
            json_resp: dict = self.to_json(response.text)
            if "captchaUrl" in json_resp:
                captcha_code: str = self.handle_captcha(json_resp["captchaUrl"])
                if not captcha_code:
                    print("[ERROR] Could not solve captcha.")
                    return False
                # Add captcha code to the fields and retry
                fields["captCode"] = captcha_code
                print("[DEBUG] Retrying login with captcha.")
                response = self._session.post(url, headers=headers, params=fields, allow_redirects=False)
                print(f"[DEBUG] login_step_2: Retry Response text: {response.text[:2000]}")
                if response is not None and response.status_code == 200:
                    json_resp = self.to_json(response.text)
                else:
                    print("[ERROR] Login failed even after captcha.")
                    return False

            valid = "ssecurity" in json_resp and len(str(json_resp["ssecurity"])) > 4
            if valid:
                self._ssecurity = json_resp["ssecurity"]
                self.userId = json_resp.get("userId", None)
                self._cUserId = json_resp.get("cUserId", None)
                self._passToken = json_resp.get("passToken", None)
                self._location = json_resp.get("location", None)
                self._code = json_resp.get("code", None)
            else:
                if "notificationUrl" in json_resp:
                    print("Two factor authentication required, please use following url and restart extractor:")
                    print(json_resp["notificationUrl"])
                    print()
                else:
                    print(f"[ERROR] login_step_2: Login failed, server returned: {json_resp}")
        else:
            print(f"[ERROR] login_step_2: HTTP status {response.status_code}. Response: {response.text[:500]}")
        return valid

Hope it helps.

If there is interest from the main contributor, I can also create a GUI for the script.

[Pachinko0]

Same over here! Would love the windows .exe to be updated if possible.

[fabien-haff]

I am having the same issue, I get a captchaUrl field as well. Could you share your solution? Or could you tell me how to include the captcha code in the request?

I can quickly copy paste my code here but it has not been thoroughly tested. I can only say that it has worked for me.

    def handle_captcha(self, captcha_url: str) -> str:
        import tempfile
        from PIL import Image

        # Full URL in case it s relative
        if captcha_url.startswith("/"):
            captcha_url = "https://account.xiaomi.com" + captcha_url

        print(f"[DEBUG] Downloading captcha image from: {captcha_url}")
        response = self._session.get(captcha_url, stream=True)
        if response.status_code != 200:
            print("[ERROR] Unable to fetch captcha image.")
            return ""

        # Save image to a temporary file
        with tempfile.NamedTemporaryFile(delete=False, suffix=".jpg") as tmp:
            for chunk in response.iter_content(1024):
                tmp.write(chunk)
            tmp_path: str = tmp.name

        print(f"[INFO] Captcha image saved at: {tmp_path}")

        # Open image usig PIL. Should fallback to default image viewer but not tsted
        try:
            img = Image.open(tmp_path)
            img.show()
        except Exception:
            print(f"[INFO] Please open {tmp_path} and solve the captcha.")

        # Ask user for captcha solution
        captcha_solution: str = input("Enter captcha as shown in the image: ").strip()
        return captcha_solution

   def login_step_2(self) -> bool:

        url: str = "https://account.xiaomi.com/pass/serviceLoginAuth2"
        headers: dict = {
            "User-Agent": self._agent,
            "Content-Type": "application/x-www-form-urlencoded"
        }
        fields: dict = {
            "sid": "xiaomiio",
            "hash": hashlib.md5(str.encode(self._password)).hexdigest().upper(),
            "callback": "https://sts.api.io.mi.com/sts",
            "qs": "%3Fsid%3Dxiaomiio%26_json%3Dtrue",
            "user": self._username,
            "_sign": self._sign,
            "_json": "true"
        }
        print(f"[DEBUG] login_step_2: URL: {url}")
        print(f"[DEBUG] login_step_2: Fields: {fields}")

        response = self._session.post(url, headers=headers, params=fields, allow_redirects=False)
        print(f"[DEBUG] login_step_2: Response text: {response.text[:2000]}")

        valid: bool = response is not None and response.status_code == 200

        if valid:
            json_resp: dict = self.to_json(response.text)
            if "captchaUrl" in json_resp:
                captcha_code: str = self.handle_captcha(json_resp["captchaUrl"])
                if not captcha_code:
                    print("[ERROR] Could not solve captcha.")
                    return False
                # Add captcha code to the fields and retry
                fields["captCode"] = captcha_code
                print("[DEBUG] Retrying login with captcha.")
                response = self._session.post(url, headers=headers, params=fields, allow_redirects=False)
                print(f"[DEBUG] login_step_2: Retry Response text: {response.text[:2000]}")
                if response is not None and response.status_code == 200:
                    json_resp = self.to_json(response.text)
                else:
                    print("[ERROR] Login failed even after captcha.")
                    return False

            valid = "ssecurity" in json_resp and len(str(json_resp["ssecurity"])) > 4
            if valid:
                self._ssecurity = json_resp["ssecurity"]
                self.userId = json_resp.get("userId", None)
                self._cUserId = json_resp.get("cUserId", None)
                self._passToken = json_resp.get("passToken", None)
                self._location = json_resp.get("location", None)
                self._code = json_resp.get("code", None)
            else:
                if "notificationUrl" in json_resp:
                    print("Two factor authentication required, please use following url and restart extractor:")
                    print(json_resp["notificationUrl"])
                    print()
                else:
                    print(f"[ERROR] login_step_2: Login failed, server returned: {json_resp}")
        else:
            print(f"[ERROR] login_step_2: HTTP status {response.status_code}. Response: {response.text[:500]}")
        return valid

Hope it helps.

If there is interest from the main contributor, I can also create a GUI for the script.

Works fine, thanks ! dont forget to add Pillow to requirements.txt

[hardycheng-github]

@NedAlex94 Your solution works for me, but the Xiaomi account should be login on the web first on your PC, and the Pillow library needs to be added to requirements.txt.

[TouTje]

@NedAlex94 Thanks! Your code is working for me.

[ApplY3D]

In my app (ApplY3D/mi-home-toolkit#9), after submitting a valid or invalid captcha, I encounter this error every time:
{"captchaUrl":"/pass/getCode?icodeType=login&0.7062539398799296","code":87001,"desc":"验证码输入错误","type":"manMachine"}

[pol409887]

def handle_captcha(self, captcha_url: str) -> str:
    import tempfile
    from PIL import Image

    # Full URL in case it s relative
    if captcha_url.startswith("/"):
        captcha_url = "https://account.xiaomi.com" + captcha_url

    print(f"[DEBUG] Downloading captcha image from: {captcha_url}")
    response = self._session.get(captcha_url, stream=True)
    if response.status_code != 200:
        print("[ERROR] Unable to fetch captcha image.")
        return ""

    # Save image to a temporary file
    with tempfile.NamedTemporaryFile(delete=False, suffix=".jpg") as tmp:
        for chunk in response.iter_content(1024):
            tmp.write(chunk)
        tmp_path: str = tmp.name

    print(f"[INFO] Captcha image saved at: {tmp_path}")

    # Open image usig PIL. Should fallback to default image viewer but not tsted
    try:
        img = Image.open(tmp_path)
        img.show()
    except Exception:
        print(f"[INFO] Please open {tmp_path} and solve the captcha.")

    # Ask user for captcha solution
    captcha_solution: str = input("Enter captcha as shown in the image: ").strip()
    return captcha_solution

def login_step_2(self) -> bool:

    url: str = "https://account.xiaomi.com/pass/serviceLoginAuth2"
    headers: dict = {
        "User-Agent": self._agent,
        "Content-Type": "application/x-www-form-urlencoded"
    }
    fields: dict = {
        "sid": "xiaomiio",
        "hash": hashlib.md5(str.encode(self._password)).hexdigest().upper(),
        "callback": "https://sts.api.io.mi.com/sts",
        "qs": "%3Fsid%3Dxiaomiio%26_json%3Dtrue",
        "user": self._username,
        "_sign": self._sign,
        "_json": "true"
    }
    print(f"[DEBUG] login_step_2: URL: {url}")
    print(f"[DEBUG] login_step_2: Fields: {fields}")

    response = self._session.post(url, headers=headers, params=fields, allow_redirects=False)
    print(f"[DEBUG] login_step_2: Response text: {response.text[:2000]}")

    valid: bool = response is not None and response.status_code == 200

    if valid:
        json_resp: dict = self.to_json(response.text)
        if "captchaUrl" in json_resp:
            captcha_code: str = self.handle_captcha(json_resp["captchaUrl"])
            if not captcha_code:
                print("[ERROR] Could not solve captcha.")
                return False
            # Add captcha code to the fields and retry
            fields["captCode"] = captcha_code
            print("[DEBUG] Retrying login with captcha.")
            response = self._session.post(url, headers=headers, params=fields, allow_redirects=False)
            print(f"[DEBUG] login_step_2: Retry Response text: {response.text[:2000]}")
            if response is not None and response.status_code == 200:
                json_resp = self.to_json(response.text)
            else:
                print("[ERROR] Login failed even after captcha.")
                return False

        valid = "ssecurity" in json_resp and len(str(json_resp["ssecurity"])) > 4
        if valid:
            self._ssecurity = json_resp["ssecurity"]
            self.userId = json_resp.get("userId", None)
            self._cUserId = json_resp.get("cUserId", None)
            self._passToken = json_resp.get("passToken", None)
            self._location = json_resp.get("location", None)
            self._code = json_resp.get("code", None)
        else:
            if "notificationUrl" in json_resp:
                print("Two factor authentication required, please use following url and restart extractor:")
                print(json_resp["notificationUrl"])
                print()
            else:
                print(f"[ERROR] login_step_2: Login failed, server returned: {json_resp}")
    else:
        print(f"[ERROR] login_step_2: HTTP status {response.status_code}. Response: {response.text[:500]}")
    return valid

Mam nadzieję, że to pomoże.

Jeśli główny współpracownik będzie zainteresowany, mogę też stworzyć interfejs graficzny dla skryptu.

Can you provide instructions on where and how to add it?