Broken login

[112RG]

It seems tidal has changed there token. But from testing the mobile app 1.9.1 Mobile login isn't working on that version either.

Replacing the API_TOKEN with updated one allows the first login but it fails on the second login using MASTER_API_TOKEN. I have no clue where this MASTER_API_TOKEN comes from digging around in mitmproxy I can't seem to dig any value up that works

Also whats weird is tidal doesn't return a

<Response [401]>
Authentication failed: Invalid token

With the old token which I would expect it would. Instead it returns

<Response [401]>
Authentication failed: None

[evan-goode]

Thanks, that's unfortunate. I took MASTER_API_TOKEN from this project: https://github.com/yaronzz/Tidal-Media-Downloader/blob/cc35e94fa21f567a54675d2fad62a4e77cd20ee2/TIDALDL-PY/tidal_dl/tidal.py#L448. I assume the developer got it from one of the desktop clients?

It might be time to get to work reversing the new OAUTH login flow. I've noticed some captchas in the app, I hope we won't have to deal with those.

[112RG]

After debugging the desktop app the TOKEN in the POST to https://et.tidal.com/api/public/events
Can be used to login and get flacs. Your version seems to be the only able to get FLACS others still get mp4 with the same token

[evan-goode]

Swapped out the API token and changed the API endpoint used for getting media URLs. Everything should be working now, MQA included.

[112RG]

Nice I fixed redsea just with the API token. Is the new endpoint worth using? Seems it only allows no encrypted MQA files

[evan-goode]

Do you mean that some tracks aren't available using this new API path (playbackinfopostpaywall)? Could you share an example?

[112RG]

Oh no I mean that the only difference with this endpoint and the other is unencrypted MQA files.

[evan-goode]

Oh good, yeah I thought that was weird. Seems to work fine though ¯\(ツ)/¯

[yaronzz]

Thanks, that's unfortunate. I took MASTER_API_TOKEN from this project: https://github.com/yaronzz/Tidal-Media-Downloader/blob/cc35e94fa21f567a54675d2fad62a4e77cd20ee2/TIDALDL-PY/tidal_dl/tidal.py#L448. I assume the developer got it from one of the desktop clients?

It might be time to get to work reversing the new OAUTH login flow. I've noticed some captchas in the app, I hope we won't have to deal with those.

The MASTER_API_TOKEN comes from Redsea: https://github.com/redsudo/RedSea/blob/master/redsea/decryption.py.
How did you get the API_TOKEN "MbjR4DLXz1ghC4rV"?
I tested many tokens, but none of them work.