Error 400: invalid_request when authenticating with Google

[WKHarmon]

The problem

I installed the ha-nest-protect integration through HACS and restarted. I'm trying to add the integration now and when I click on the "authorize your account" link I get this error:

Clicking into the error details shows the following:

Error 400: invalid_request
The out-of-band (OOB) flow has been blocked in order to keep users secure. Follow the Out-of-Band (OOB) flow Migration Guide linked in the developer docs below to migrate your app to an alternative method.
Request details: access_type=offline response_type=code redirect_uri=urn:ietf:wg:oauth:2.0:oob client_id= scope=openid https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/nest-account

I've tried it on two separate browsers to the same result.

Edited to add: I found this page: https://developers.google.com/identity/protocols/oauth2/resources/oob-migration

I was successfully able to get a token by appending a ack_oob_shutdown=2022-10-03 parameter to the query string on the auth url.

What version of this integration (ha-nest-protect) has the issue?

0.3.8

What version of Home Assistant Core has the issue?

2022.10.0

Device / Model

Nest Protect (Battery)

Diagnostics information

No response

Home Assistant log

No response

Additional information

No response

[WKHarmon]

I found this page: https://developers.google.com/identity/protocols/oauth2/resources/oob-migration

I was successfully able to get a token by appending a ack_oob_shutdown=2022-10-03 parameter to the query string on the auth url.

[MarElemans]

Thanks! Worked for me

[kcline]

You're solution worked for me too, just commenting to say thanks and add that you need to append &ack_oob_shutdown=2022-10-03 to the url provided in the setup steps (right click the link from HA and copy url, append the command to the link, then paste it into a browser).

I'm definitely not a programmer, more of a tinker'er, so this took me a bit longer to remember to add the & to properly append it. Mostly commenting in case others in my situation (and knowledge level) come across this issue before it's fixed.

[iMicknl]

I will have to fix this in the component indeed; however it worries me that this will eventually be deprecated.

[norwegianisthekey]

I just tried it myself and got the same error but my solution was to press use another account then just use the same google account and it worked. (it gives out a warning about soon it will be deprecated) but yeah quick fix..

[semple1990]

Just highlighting kcline's comment about adding the & as i missed that briefly and wondered why it wasn't working.

So the authorization url should end in ...apps.googleusercontent.com

You'll want to add &ack_oob_shutdown=2022-10-03 to the end to make:

...apps.googleusercontent.com&ack_oob_shutdown=2022-10-03

[FlyersPh9]

Appending &ack_oob_shutdown=2022-10-03 to the end of the URL copied from in HA wasn't working for me. I instead opened the link incognito and was able to get my access token that way.

[water-escape]

i got the access token, but when entering it in HA it give the error " unexpected error" or " invalid authentication"...not sure what now..

[iMicknl]

@water-escape can you create a new issue for this and include your log files? Unexpected error should be logged to your Home Assistant log. Invalid authentication means that the server rejects the token.

[jpearce73]

Just highlighting kcline's comment about adding the & as i missed that briefly and wondered why it wasn't working.

So the authorization url should end in ...apps.googleusercontent.com

You'll want to add &ack_oob_shutdown=2022-10-03 to the end to make:

...apps.googleusercontent.com&ack_oob_shutdown=2022-10-03

I am getting something slightly different out of the UI link. I already have an extra parameter. My URL looks like this
https://.............apps.googleusercontent.com&flowName=GeneralOAuthFlow
Perhaps because I have a few Google accounts?
The reply gives me this page

Continuing with my chosen ID fails with the message shown at the top of this thread, whether I append '&ack_oob_shutdown=2022-10-03' or not

[redford-jones]

The workaround above appears to have stopped working, at least for me. I consistently get a 400 despite adding the query string shown above.

[tre4b]

I too have this issue, exactly the same as the OP.

One thing I wondered is whether this is down to the fact that the google account I am using is not my default account. That one is a GSuite account and Nest does not work with those so I had to create an individual account. I am logged into that account when I attempt to link the integration but get the message above...

[hallidaydaniel]

Just highlighting kcline's comment about adding the & as i missed that briefly and wondered why it wasn't working.
So the authorization url should end in ...apps.googleusercontent.com
You'll want to add &ack_oob_shutdown=2022-10-03 to the end to make:
...apps.googleusercontent.com&ack_oob_shutdown=2022-10-03

I am getting something slightly different out of the UI link. I already have an extra parameter. My URL looks like this https://.............apps.googleusercontent.com&flowName=GeneralOAuthFlow Perhaps because I have a few Google accounts? The reply gives me this page

Continuing with my chosen ID fails with the message shown at the top of this thread, whether I append '&ack_oob_shutdown=2022-10-03' or not

yes, I get the same behaviours as this now sadly - not managed to find work around

[idroyIT]

Also the same issue. With &ack_oob_shutdown=2022-10-03 still a 400 error.

[benceh90]

The same problem here. OOB is outdated :(

[Tatey53]

Yes, I can confirm that I get the same 400 error, and adding &ack_oob_shutdown=2022-10-03 gets me past it, but after selecting my account if goes back to the same 400 error

[schmittx]

Same issue here as well.

To clarify for everyone; the OOB flow method appears to be fully deprecated now as of 10/3 according to the Google article that @WKHarmon posted, regardless if the additional parameter is added or not.

Hopefully @iMicknl can update this repo to use the "cookies" auth method that homebridge-nest now solely relies on.

[pmkruyen]

After I encountered this problem and solved it(?), I read this thread.

Original approach

• made new google account
• Set up nest account in app (ios)
• Ran login.js in Homebridge
• —> error

Solution:

• Logged in on Nest portal, had to give Nest access to my account
• Started a ne sesion of homebridge in incognito browser
• Ran login.js
• —> Solved: Got the access token

(Don’t know if the plugin works now, because I haven’t adopted any Nest devices yet)

Aha, I now see that this method will be de appreciated ; that the cookie method needs to be used.

[simtreti]

@iMicknl Will you update the repo to correct that issue ?

[iMicknl]

@simtreti eventually, yes. However my time currently is very scarce, so I am open to PR's.

I am not a fan of the cookie method, I have to say, since this is not an easy method for many users. I will need to say if there can be a workaround for this issue, but that will take time.

[simtreti]

@iMicknl Take your time it was just to know if I need to check elsewhere to integrate my new nest protect into HA.

[m3tc0n]

I have the same problem. Hopefully this will be resolved soon.

[sadicarnot]

Before I got into Home Assistant, I had gotten the Starling Home Hub and I was able to get the Protects into Home Assistant via the Starling and HomeKit Controller.

[Monacoslo]

So what is now the solution, how to get Access Tooken now?

[iMicknl]

Before I got into Home Assistant, I had gotten the Starling Home Hub and I was able to get the Protects into Home Assistant via the Starling and HomeKit Controller.

Depending on what they use, we could change this integration as well. Unfortunately, the most user-friendly way of generating a token does not seem supported anymore.

Currently my time is very limited, thus I did not have time to look into this issue. Contributions to this integration are always welcome. Otherwise, we would just need to wait. If you are able to generate a token in a different way, you can pass this in the integration as well.

[Monacoslo]

But are there any other options how to get token?

[MaJonker]

What an extremely buggy solution... I have been trying to integrate Nest into Home Assistant for weeks and have no luck whatsoever. The official Google-way is complicated AF and totally does not work, this solution seemed hopeful until this error. Adding stuff to the url did not help. Any thoughts on how to get an authentication?

[iMicknl]

@Monacoslo @MaJonker let's move the asks / discussion to the Home Assistant Community Forum: https://community.home-assistant.io/t/support-for-nest-protect/310084/last.

Unfortunately, Google changed their authentication mechanism, and this was a risk we knew from the beginning. The aim of this integration was to offer the most user-friendly way of authenticating to Nest server and including Nest Protect in our Home Assistant installation, until Google finally adds support to their SDM API (official API).

Let's discuss actual workarounds and investigating of the issue here.

[Trembler34]

Looks like it already stopped working. Is this kind of the expectation with this kind of setup using cookies on a browser and relying on that account staying signed into the browser? or is there going to be some way to make sure this stays more consistently connected?

[iMicknl]

@Trembler34 let's discuss this in a new issue if you still face issues, and keep this issue open for mor general discussion. Best is to use Incognite mode and the instructions from #272.

[Trembler34]

I set it up per the instructions. Worked fine for 24hrs then died. I’m of the understanding that this is just kind of how it is with this current method. I decided to set it up again from a chrome browser that runs on a server that never gets touched and so far it’s been more solid. At this point I am good. Will keep an eye out for changes in the future. Thanks for the follow up.

[Technically-Possible]

im struggling to get past this part I can't choose a different version to download I don't know what to do from here any advice

[iMicknl]

@Technically-Possible you need the beta version. Select "use pre-release" in HACS, or download beta version from GitHub.

[Technically-Possible]

my cameras are accessible under https://home.google.com will this process of getting the cookies still work in this case

[Technically-Possible]

i assume this is because the cams are only able to be seen on https://home.google.com/ not home.nest

[iMicknl]

@Technically-Possible this integration is for the Nest Protect smoke alarm. We don’t support the cameras.

[techfixpros]

Please add to the instructions to enable third party cookies in incognito mode. Just spent an hour trying to figure out why none of the calls were showing up in the pane.

[tonyrsutton]

So, will this ever be fixed or not?

Thanks.

[hesspoint]

Broken again after latest update 2024.2.3.
Failed Setup will retry.

Tried to add entry and entered my credentials as per the instructions and it says already setup.

[techfixpros]

Please add to the instructions to enable third party cookies in incognito mode. Just spent an hour trying to figure out why none of the calls were showing up in the pane.

NOTE: The current beta is working properly for over 24 hours now. I would assume this issue can be closed as soon as the beta is merged to main.

[tonyrsutton]

Good news. Any ideas when that will happen?

Thanks for the update.

[hesspoint]

I just checked have the latest beta v0.4.0b4. Even re-downloaded it.

Still broken

[iMicknl]

@hesspoint please create a new issue and define what 'still broken' means. If you face the same problem as described in this issue, you definitely aren't running the beta version.

[hesspoint]

@hesspoint please create a new issue and define what 'still broken' means. If you face the same problem as described in this issue, you definitely aren't running the beta version.

Well yes and no. I am running the beta for quite a while not and could connect using the issue token and cookie. That was working well for quite some time. With the latest update of HA 2024.2.3 it suddenly stopped working and says Failed Setup will retry. Also restart won't fix it.

I tried to click "add entry" and I grabbed and pasted the issue token and cookie again (as per instructions). Then I got the error message that an entry already exists and that's it, Still does not work

[nota3k]

Seeing the same issue as @hesspoint . Updated to latest beta v0.4.0b4, was on v0.4.0b1 before but it stopped working with some HA update in the past week or two that I updated to.

[iMicknl]

Please create a new issue with more details and your log.

[adambullmer]

Seems as of 2023-01-31 the workaround posted above doesn't work anymore and this app probably needs to migrate its auth instructions: https://developers.google.com/identity/protocols/oauth2/resources/oob-migration

[iMicknl]

@adambullmer that is discussed extensively in this thread already. You need to use the beta for a new auth method (which is not great, but the only one working).

[adambullmer]

oh! Missed the year timestamp on the comments changing and didn't see this had been commented post shutoff 🤦‍♂️. I appreciate the clarification. I think the switch up from the OB acknowledge workaround and to the beta version (using a new auth flow) got lost in github's comment rollup, and I had thought the beta was just for appending the query param automatically. I'll give the beta a whirl