Unable to authenticate. 403 code

[commadelimited]

Trying to login to test this library out and I'm getting an error. I've made sure to install gspread. I created a single python file, test.py. My code is as simple as it gets:

import gspread

# Login with your Google account
gc = gspread.login('<username>', '<password>')

Yet when I run this via the terminal python test.py I get the following error:

Traceback (most recent call last):
  File "test.py", line 4, in <module>
    gc = gspread.login('<username>', '<password>')
  File "/Library/Python/2.7/site-packages/gspread/client.py", line 278, in login
    client.login()
  File "/Library/Python/2.7/site-packages/gspread/client.py", line 99, in login
    raise AuthenticationError("Unable to authenticate. %s code" % ex.code)
gspread.exceptions.AuthenticationError: Unable to authenticate. 403 code

I confirmed that my login credentials were correct by logging out of Google docs, then logging back in, then copying and pasting the u/p into test.py and still nothing. Any suggestions?

[commadelimited]

btw. I'm using Python 2.7.1

[commadelimited]

It looks like the primary issue might be that your authentication schema is incorrect. in client.py, line 31-32 look like this:

AUTH_SERVER = 'https://www.google.com'
SPREADSHEETS_SERVER = 'spreadsheets.google.com'

While signing into a Google property takes me to this URL:

https://accounts.google.com/ServiceLogin

[commadelimited]

Or maybe not. I tried the official Google Python library and it gives me the same error. I don't get it. I've logged in successfully, then copied/pasted my credentials into the login method and still no joy. Is my pw supposed to be plain text in the login method call?

[commadelimited]

Looks like this was an issue with Google's two factor authorization. I'm submitting a pull request to update the docs for other's benefit.

[commadelimited]

#46

[burnash]

Great, many thanks for discovering this!

[commadelimited]

No problem. Your library works great.

[burnash]

Thank you

[idcrook]

gdata does seem to work for me is I instead use an application-specific password from the two-factor authentication settings page...

[flyingfoxlee]

It's happens to me too, but in my case, it was caused by login to google from a suspicious ip. so I login the online account and find google warn me with the message "We detected activity on your Google Account from a location you don't usually sign in from. Review the information below and tell us whether you recognize this activity". I can recognize that activity and it works. Thanks for the great library~

[burnash]

Thanks for sharing this!

[tcorbettclark]

gspread works fine for me with two factor authentication. You just need to create and use an application-specific password:

https://accounts.google.com/b/0/IssuedAuthSubTokens?hl=en_GB

Your username is your email as usual.

It is better this way anyway since your main user password is not used anywhere near your code, and the application specific password can be discarded/revoked independently.

[burnash]

@tcorbettclark Thanks for the finding!

[jwal]

You can also get a 403 error when Google thinks that your login is suspicious. I was logging in using a dedicated robot Google account from a Jenkins server hosted on Amazon EC2. I had to do two things:

• Mark the activity as not suspicious: https://security.google.com/settings/security/activity?hl=en&pli=1
• Bypass the capcha: http://www.google.com/accounts/DisplayUnlockCaptcha (thanks to http://serverfault.com/questions/550189/gmail-rejecting-imap-calls-from-aws-ec2-hosted-james-server#comment636128_550189 )

I hope this helps.

[multivoxmuse]

I came here looking for exactly the answer @tcorbettclark gave. It was my 2-factor auth. I had also been wondering how the heck I could get away from using my personal password in my script anyway.

Thanks!

[abhinavabcd]

@jwal .. thanks , you comment saved my time.

[fiatjaf]

@jwal saves lifes.

[sanderjo]

To confirm & FYI:

I had the same "gspread.exceptions.AuthenticationError: Unable to authenticate. 403 code"

After the failed gspread logon, I immediately received a mail from Google/Gmail (no-reply@accounts.google.com) in my gmail about a suspicous login attempt. I confirmed the login request was OK, and went to https://www.google.com/settings/security/lesssecureapps to accept lower-security apps to access my gmail account.

After that, the gspread login went OK.

PS: @burnash What a fantastic piece of software gspread is. Thank you very much!

[grillazz]

thx @sanderjo

[burnash]

@sanderjo Thanks for the feedback 👍

[Glench]

@jwal Thanks for the helpful comment! The second step worked for me.

[sanderjo]

And one more update:

I got the 403 with another account I just created, and clicking on the URL https://www.google.com/settings/security/lesssecureapps did not solve it.

More digging revealed I had to also go to this URL: https://accounts.google.com/DisplayUnlockCaptcha, and after that I could use gspread.

FWIW: I put some extra logging into line 112 of gspread/client.py and that revealed this:

gspread.exceptions.AuthenticationError: Unable to authenticate. 403 code with content 
Error=BadAuthentication
Url=https://www.google.com/accounts/ContinueSignIn?blabla
Info=WebLoginRequired

Googling "Info=WebLoginRequired" led me to that URL https://accounts.google.com/DisplayUnlockCaptcha

HTH

[gluefish]

Please update your GSpread API Reference.

The GSpread API Reference still says:

gspread.login(email, password)
Login to Google API using email and password.
This is a shortcut function which instantiates Client and performs login right away.
Returns: Client instance.

But, when I run it that way it says:
Warning:
ClientLogin is deprecated:
https://developers.google.com/identity/protocols/AuthForInstalledApps?csw=1
Authorization with email and password will stop working on April 20, 2015.