BMW cars cannot be authorised - issue with key exchange between evcc and BMW cardata

[ansgarherkert]

Describe the bug

I and another evcc user (NaegeleF) cannot connect our BMW cars to evcc. We had some discussions with mfuchs1984 (discussion #26254 partially in German) but he also could not help. I therefore raise an issue now.

I have setup the cardata streams in the BMW website (in line with evcc documentation). The stream and API are shown as "active" on the BMW website.

I have configured my cars (I have 2 BMW i3s) in evcc.yaml. In the GUI I can then request to connect the cars. I get the key generated by evcc and then put this key in the BMW website for confirmation. The BMW site confirms that the login was successful.

When I return to evcc nothing has happened and I am still at the window from which the authorisation key can be requested. There seems to be an issue with the key exchange.

I have tried this with version 300.2 and the previous version (have just updated versions).
I have tried it from a direct install on Debian (Intel PC), a Docker container (Synology) and from a home assistant add-in install (Synology).
Same result in all cases.

The rest of the evcc system is working normal as expected.

Here some screenshots below.

Many thanks in advance for your help. Please let me know if I should provide additional data/info. This is my first issue raised and therefore might not have done everything as required.

I have not checked the lasted nightly build (although I have checked the box below). If I need to do this, I will do so but felt that this is not necessary as I used the last 2 production builds.

(Wenn Deutsch als Sprache bevorzugt wird, gerne weiter in Deutsch.)

Steps to reproduce

1. create BMW cardata config in evcc.yaml and setup cardata stream on BMW website
2. in evcc attempt to authorise the car(s)
3. get no result, only error in log file

Configuration details

vehicles:
- type: template
  template: cardata
  title: i3sAnsgar
  capacity: 39
  vin: WBY8P610207Kxxxxx # modified
  clientid: F2782EB7-9CE4-40C3-9B08-xxxxxxxxxx # modified
  name: ev2
- type: template
  template: cardata
  title: i3sMakiko
  capacity: 39
  vin: WBY8P610207Gxxxxx #modifed
  clientid: F2782EB7-9CE4-40C3-9B08-xxxxxxxxxx # modified
  name: ev1

Log details

Last trace from today created in homeassistant:

[httpd ] TRACE 2026/01/02 00:15:25 GET /providerauth/login
[providerauth] DEBUG 2026/01/02 00:15:25 login request for: F2782EB7-9CE4-40C3-9B08-D6832ABF59EF-528e4c2a
[cardata] TRACE 2026/01/02 00:15:25 POST https://customer.bmwgroup.com/gcdm/oauth/device/code
[cardata] TRACE 2026/01/02 00:15:25 client_id=***&code_challenge=Pb3ceyIG7YZgGVSONnR5EzTKi-s_Msf-t41L8mwg800&code_challenge_method=S256&scope=authenticate_user+openid+cardata%3Astreaming%3Aread+cardata%3Aapi%3Aread -- {"user_code":"Yfxr2xbh","device_code":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsIm5iZiI6MTc2NzMwOTMyNSwidXNlcl9jb2RlIjoiWWZ4cjJ4YmgiLCJpc3MiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsImV4cCI6MTc2NzMwOTYyNSwiaWF0IjoxNzY3MzA5MzI1LCJqdGkiOiI4NTBmN2E2MC00Y2YzLTQwOGMtOTBmZi00MWM2NzVkNzFhYT
[cardata] TRACE 2026/01/02 00:15:30 POST https://customer.bmwgroup.com/gcdm/oauth/token
[cardata] TRACE 2026/01/02 00:15:30 client_id=***&code_verifier=ORO44Vzk_NL7deFLzPypwRYbqjIZ_jf83OH2OsnPcXM&device_code=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsIm5iZiI6MTc2NzMwOTMyNSwidXNlcl9jb2RlIjoiWWZ4cjJ4YmgiLCJpc3MiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsImV4cCI6MTc2NzMwOTYyNSwiaWF0IjoxNzY3MzA5MzI1LCJqdGkiOiI4NTBmN2E2MC00Y2YzLTQwOGMtOTBmZi00MWM2NzVkNzFhYTUifQ.3zah_U_DuV5OF2i851G-AhLADljv2Ib5OpLGgeM6ChY&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code&scope=authenticate_user+openid+cardata%3Astreaming%3Aread+cardata%3Aapi%3Aread -- {"error_description":"The user has not yet completed authorization","error":"authorization_pending"}
[cardata] TRACE 2026/01/02 00:15:35 POST https://customer.bmwgroup.com/gcdm/oauth/token
[cardata] TRACE 2026/01/02 00:15:35 client_id=***&code_verifier=ORO44Vzk_NL7deFLzPypwRYbqjIZ_jf83OH2OsnPcXM&device_code=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsIm5iZiI6MTc2NzMwOTMyNSwidXNlcl9jb2RlIjoiWWZ4cjJ4YmgiLCJpc3MiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsImV4cCI6MTc2NzMwOTYyNSwiaWF0IjoxNzY3MzA5MzI1LCJqdGkiOiI4NTBmN2E2MC00Y2YzLTQwOGMtOTBmZi00MWM2NzVkNzFhYTUifQ.3zah_U_DuV5OF2i851G-AhLADljv2Ib5OpLGgeM6ChY&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code&scope=authenticate_user+openid+cardata%3Astreaming%3Aread+cardata%3Aapi%3Aread -- {"error_description":"The polling interval has not elapsed since the last request","error":"slow_down"}
[cardata] TRACE 2026/01/02 00:15:45 POST https://customer.bmwgroup.com/gcdm/oauth/token
[cardata] TRACE 2026/01/02 00:15:45 client_id=***&code_verifier=ORO44Vzk_NL7deFLzPypwRYbqjIZ_jf83OH2OsnPcXM&device_code=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsIm5iZiI6MTc2NzMwOTMyNSwidXNlcl9jb2RlIjoiWWZ4cjJ4YmgiLCJpc3MiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsImV4cCI6MTc2NzMwOTYyNSwiaWF0IjoxNzY3MzA5MzI1LCJqdGkiOiI4NTBmN2E2MC00Y2YzLTQwOGMtOTBmZi00MWM2NzVkNzFhYTUifQ.3zah_U_DuV5OF2i851G-AhLADljv2Ib5OpLGgeM6ChY&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code&scope=authenticate_user+openid+cardata%3Astreaming%3Aread+cardata%3Aapi%3Aread -- {"fault":{"faultstring":"Invalid Access Token","detail":{"errorcode":"keymanagement.service.invalid_access_token"}}}
[cardata] ERROR 2026/01/02 00:15:45 error retrieving token: oauth2: cannot fetch token: 500 Internal Server Error Response: {"fault":{"faultstring":"Invalid Access Token","detail":{"errorcode":"keymanagement.service.invalid_access_token"}}}

What type of operating system or environment does evcc run on?

Linux

External automation

• I have made sure that no external automation like HomeAssistant or Node-RED is active or accessing any of the mentioned devices when this issue occurs.

Nightly build

• I have verified that the issue is reproducible with the latest nightly build

Version

0.300.2

[andig]

When I return to evcc nothing has happened and I am still at the window from which the authorisation key can be requested. There seems to be an issue with the key exchange.

Wait up to 1 minute. BMW is using device auth, its async.

@naltatis maybe we need to make this clearer?

[naltatis]

@andig can we somehow detect this in-between state from ui?

[ansgarherkert]

@andig
@naltatis

I have restarted evcc and rerun the process. I have waited 10 minutes with the pop-up screen of evcc still there.
No success. Hear the new log extract. I have not seen any cardate related log entries after the last entry I have include below.

I therefore think there is a deeper issue that cannot be solved by waiting.

[httpd ] TRACE 2026/01/02 15:58:51 GET /providerauth/login
[providerauth] DEBUG 2026/01/02 15:58:51 login request for: F2782EB7-9CE4-40C3-9B08-D6832ABF59EF-528e4c2a
[cardata] TRACE 2026/01/02 15:58:51 POST https://customer.bmwgroup.com/gcdm/oauth/device/code
[cardata] TRACE 2026/01/02 15:58:51 client_id=***&code_challenge=UAfbo3EUIUKaS9Jkmhr1eP96K0vnDzss2tkPO5Y564k&code_challenge_method=S256&scope=authenticate_user+openid+cardata%3Astreaming%3Aread+cardata%3Aapi%3Aread

{"user_code":"TGHiGRtL","device_code":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsIm5iZiI6MTc2NzM2NTkzMSwidXNlcl9jb2RlIjoiVEdIaUdSdEwiLCJpc3MiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsImV4cCI6MTc2NzM2NjIzMSwiaWF0IjoxNzY3MzY1OTMxLCJqdGkiOiJmMWVkNGM2Yy0zYWZkLTRiZjItOTc0ZS1kMjI4MmFhOGNmOTQifQ.5vEDcvIKIQGPsG9RM6FOsbrgBBXVemL-oBCnYCkQS2U","interval":5,"verification_uri":"https://customer.bmwgroup.com/oneid/link","expires_in":300}

[cardata] TRACE 2026/01/02 15:58:56 POST https://customer.bmwgroup.com/gcdm/oauth/token
[cardata] TRACE 2026/01/02 15:58:56 client_id=***&code_verifier=hjswFWWf0ZEXQ1FseiTLCOpUC-mHLudb8q61vUjUOeo&device_code=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsIm5iZiI6MTc2NzM2NTkzMSwidXNlcl9jb2RlIjoiVEdIaUdSdEwiLCJpc3MiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsImV4cCI6MTc2NzM2NjIzMSwiaWF0IjoxNzY3MzY1OTMxLCJqdGkiOiJmMWVkNGM2Yy0zYWZkLTRiZjItOTc0ZS1kMjI4MmFhOGNmOTQifQ.5vEDcvIKIQGPsG9RM6FOsbrgBBXVemL-oBCnYCkQS2U&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code&scope=authenticate_user+openid+cardata%3Astreaming%3Aread+cardata%3Aapi%3Aread

{"error_description":"The user has not yet completed authorization","error":"authorization_pending"}

[cardata] TRACE 2026/01/02 15:59:01 client_id=***&code_verifier=hjswFWWf0ZEXQ1FseiTLCOpUC-mHLudb8q61vUjUOeo&device_code=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsIm5iZiI6MTc2NzM2NTkzMSwidXNlcl9jb2RlIjoiVEdIaUdSdEwiLCJpc3MiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsImV4cCI6MTc2NzM2NjIzMSwiaWF0IjoxNzY3MzY1OTMxLCJqdGkiOiJmMWVkNGM2Yy0zYWZkLTRiZjItOTc0ZS1kMjI4MmFhOGNmOTQifQ.5vEDcvIKIQGPsG9RM6FOsbrgBBXVemL-oBCnYCkQS2U&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code&scope=authenticate_user+openid+cardata%3Astreaming%3Aread+cardata%3Aapi%3Aread

{"fault":{"faultstring":"Invalid Access Token","detail":{"errorcode":"keymanagement.service.invalid_access_token"}}}
[cardata] ERROR 2026/01/02 15:59:01 error retrieving token: oauth2: cannot fetch token: 500 Internal Server Error
Response: {"fault":{"faultstring":"Invalid Access Token","detail":{"errorcode":"keymanagement.service.invalid_access_token"}}}

[andig]

Pls format your post, it's unreadable

[ansgarherkert]

Sorry... I had copied plain text and GitHub was auto-formatting it.
Here a new try (new logging excerpt). Hope that works. Many thanks for your help!

LOGS

FATALERRORWARNINFODEBUGTRACE
All areas

[httpd ] TRACE 2026/01/02 20:39:32 GET /providerauth/login
[providerauth] DEBUG 2026/01/02 20:39:32 login request for: F2782EB7-9CE4-40C3-9B08-D6832ABF59EF-528e4c2a
[cardata] TRACE 2026/01/02 20:39:32 POST https://customer.bmwgroup.com/gcdm/oauth/device/code
[cardata] TRACE 2026/01/02 20:39:33 client_id=***&code_challenge=kNlaJGOPQbvij3ScRw0WnShOz46HSj1zyJ0BHuaGwV0&code_challenge_method=S256&scope=authenticate_user+openid+cardata%3Astreaming%3Aread+cardata%3Aapi%3Aread -- {"user_code":"tp5PqEe4","device_code":"eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsIm5iZiI6MTc2NzM4Mjc3MywidXNlcl9jb2RlIjoidHA1UHFFZTQiLCJpc3MiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsImV4cCI6MTc2NzM4MzA3MywiaWF0IjoxNzY3MzgyNzczLCJqdGkiOiIyYTkxMzdhZC04M2UwLTQ4ZjUtODRmNC02MmJiMDBiZmJkNzgifQ.GlDNEpFldwH2OoHOoSIzLERrFPPMe8JqHL4l9yY0qmk","interval":5,"verification_uri":"https://customer.bmwgroup.com/oneid/link","expires_in":300}
[cardata] TRACE 2026/01/02 20:39:38 POST https://customer.bmwgroup.com/gcdm/oauth/token
[cardata] TRACE 2026/01/02 20:39:38 client_id=***&code_verifier=Qfj0OttTHURW5CaGqiJ03FhschwixS6kq3cnp_5UQZE&device_code=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsIm5iZiI6MTc2NzM4Mjc3MywidXNlcl9jb2RlIjoidHA1UHFFZTQiLCJpc3MiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsImV4cCI6MTc2NzM4MzA3MywiaWF0IjoxNzY3MzgyNzczLCJqdGkiOiIyYTkxMzdhZC04M2UwLTQ4ZjUtODRmNC02MmJiMDBiZmJkNzgifQ.GlDNEpFldwH2OoHOoSIzLERrFPPMe8JqHL4l9yY0qmk&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code&scope=authenticate_user+openid+cardata%3Astreaming%3Aread+cardata%3Aapi%3Aread -- {"error_description":"The user has not yet completed authorization","error":"authorization_pending"}
[cardata] TRACE 2026/01/02 20:39:43 POST https://customer.bmwgroup.com/gcdm/oauth/token
[cardata] TRACE 2026/01/02 20:39:43 client_id=***&code_verifier=Qfj0OttTHURW5CaGqiJ03FhschwixS6kq3cnp_5UQZE&device_code=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsIm5iZiI6MTc2NzM4Mjc3MywidXNlcl9jb2RlIjoidHA1UHFFZTQiLCJpc3MiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsImV4cCI6MTc2NzM4MzA3MywiaWF0IjoxNzY3MzgyNzczLCJqdGkiOiIyYTkxMzdhZC04M2UwLTQ4ZjUtODRmNC02MmJiMDBiZmJkNzgifQ.GlDNEpFldwH2OoHOoSIzLERrFPPMe8JqHL4l9yY0qmk&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code&scope=authenticate_user+openid+cardata%3Astreaming%3Aread+cardata%3Aapi%3Aread -- {"error_description":"The polling interval has not elapsed since the last request","error":"slow_down"}
[cardata] TRACE 2026/01/02 20:39:53 POST https://customer.bmwgroup.com/gcdm/oauth/token
[cardata] TRACE 2026/01/02 20:39:53 client_id=***&code_verifier=Qfj0OttTHURW5CaGqiJ03FhschwixS6kq3cnp_5UQZE&device_code=eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.eyJhdWQiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsIm5iZiI6MTc2NzM4Mjc3MywidXNlcl9jb2RlIjoidHA1UHFFZTQiLCJpc3MiOiJodHRwczovL2Zvcmdlcm9jay1ncmVlbi5wcm9kLWdjZG0uZXUtY2VudHJhbC0xLmF3cy5jbG91ZC5ibXc6NDQzL2FtL29hdXRoMiIsImV4cCI6MTc2NzM4MzA3MywiaWF0IjoxNzY3MzgyNzczLCJqdGkiOiIyYTkxMzdhZC04M2UwLTQ4ZjUtODRmNC02MmJiMDBiZmJkNzgifQ.GlDNEpFldwH2OoHOoSIzLERrFPPMe8JqHL4l9yY0qmk&grant_type=urn%3Aietf%3Aparams%3Aoauth%3Agrant-type%3Adevice_code&scope=authenticate_user+openid+cardata%3Astreaming%3Aread+cardata%3Aapi%3Aread -- {"fault":{"faultstring":"Invalid Access Token","detail":{"errorcode":"keymanagement.service.invalid_access_token"}}}
[cardata] ERROR 2026/01/02 20:39:53 error retrieving token: oauth2: cannot fetch token: 500 Internal Server Error Response: {"fault":{"faultstring":"Invalid Access Token","detail":{"errorcode":"keymanagement.service.invalid_access_token"}}}```

[andig]

This does look like a BMW server issue- I'll email support. evcc keeps trying to complete the device auth and finally gets an off-topic access token error (...which doesn't event exist at this point).

[ansgarherkert]

Thanks!!!!!

[ansgarherkert]

One additional, unrelated point:
I have setup the vehicles in evcc.yaml as I have 2 vehicles of the same manufacturer. and a VIN has to be provided to differentiate them.
Do you plan to include a VIN input option on the UI so that more than 1 vehicle of the same manufacturer can be setup via the UI?

[naltatis]

Do you plan to include a VIN input option on the UI so that more than 1 vehicle of the same manufacturer can be setup via the UI?

The VIN field should appear together with other fields (capacity, ...) once the authorization has succeeded.

[andig]

Thanks!!!!!

@ansgarherkert BMW support want's you to run the auth flow through their Swagger. With that done please contact me at info@evcc.io. Closing here as probably a BMW backend issue.

[torsten2k6]

I have the same issue. What is the resolution ?
error retrieving token: oauth2: cannot fetch token: 500 Internal Server Error Response: {"fault":{"faultstring":"Invalid Access Token","detail":{"errorcode":"keymanagement.service.invalid_access_token"}}}