How do you obtain valid x-august-api-key and x-kease-api-key #5

jdhrivas · 2017-12-09T22:56:04Z

Trying to POST /session using postman but the return is "Could not get any response"
There was an error connecting to https://api-production.august.com/session.

Headers:

[  
   {  
      "key":"x-august-api-key",
      "value":"727dba56-fe45–498d-b4aa-293f96aae0e5", // I found this value on https://medium.com/@nolanbrown/august-lock-rest-apis-the-basics-7ec7f31e7874
      "description":"",
      "enabled":true
   },
   {  
      "key":"x-kease-api-key",
      "value":"727dba56-fe45–498d-b4aa-293f96aae0e5", // I found this value on https://medium.com/@nolanbrown/august-lock-rest-apis-the-basics-7ec7f31e7874
      "description":"",
      "enabled":true
   },
   {  
      "key":"Content-Type",
      "value":"application/json",
      "description":"",
      "enabled":true
   },
   {  
      "key":"User-Agent",
      "value":"August/Luna-3.2.2",
      "description":"",
      "enabled":true
   },
   {  
      "key":"Accept-Version",
      "value":"0.0.1",
      "description":"",
      "enabled":true
   }
]

Body:

{
  "installId": "b7e2efe6-dd2c-11e7-9296-cec278b6b50a", // random UUID
  "password": "<PASSWORD>",
  "identifier": "phone:+1<PHONE>"
}

The text was updated successfully, but these errors were encountered:

jmaxxz · 2018-01-24T03:12:20Z

Use the x-kease-api-key 14445b6a2dba

You will get a response like:

{
    "installId": "0",
    "applicationId": "",
    "userId": "...",
    "vInstallId": false,
    "vPassword": false,
    "vEmail": false,
    "vPhone": false,
    "hasInstallId": true,
    "hasPassword": true,
    "hasEmail": false,
    "hasPhone": false,
    "isLockedOut": false,
    "captcha": "",
    "email": [],
    "phone": [],
    "expiresAt": "2018-05-24T03:06:25.576Z",
    "LastName": "",
    "FirstName": ""
}

and an x-august-access-token header set the api key environment variable to the value of this header. Then run Send password reset email and run Verify Email with the received code.

The response will again include a x-august-access-token header that you should use as the api key environment variable.

Then run Send password reset phone and run Verify Phone with the received code.

The response will again include a x-august-access-token header that you should use as the api key environment variable.

after this you will be set.

jmaxxz · 2018-01-24T18:02:46Z

It looks like august may have changed this part of the api i will get back to you.

jmaxxz · 2018-01-27T02:13:31Z

ok in the request bodies for verify phone and verify email where is says

"value:"{{Email}}"
...
"value:"{{Phone}}"

it should be

"email:"{{Email}}"
..
"phone:"{{Phone}}"

august changed their apis.

jdhrivas · 2018-01-28T03:30:47Z

@jmaxxz excellent! I was able to obtained the x-august-api-key with the information provided.
Thank you!

jobryan · 2018-04-05T21:23:04Z

@jmaxxz Thanks for putting this Postman JSON together.

I followed your instructions from Jan 23rd above as follows:

(1) Sign-in using my credentials and x-august-api-key "14445b6a2dba".
(2) Send password reset email using the returned x-august-access-token (very long JWT with 3 parts separated by ".") and x-august-api-key "14445b6a2dba".

At Step 2, there's a long stall and then no response. Any ideas here?

POST /session
Response:

{
"installId": "0",
"applicationId": "",
"userId": "a315f74d-13b4-5c29-adf4-0bd25cbe91d6",
"vInstallId": false,
"vPassword": true,
"vEmail": false,
"vPhone": false,
"hasInstallId": true,
"hasPassword": true,
"hasEmail": true,
"hasPhone": true,
"isLockedOut": false,
"captcha": "",
"email": [],
"phone": [],
"expiresAt": "2018-08-04T02:16:21.393Z",
"LastName": "",
"FirstName": ""
}

which differs from your example above in that "vPassword" is true. Not sure if that's an issue or not...

Then, using the x-august-access-token from the response header:

POST /validation/email
Using Postman with

Headers:
Content-Type: application/json
x-august-api-key: 14445b6a2dba
x-august-access-token: eyJ0eXAiOiJKV1QiLCJhbGciOiJIUzI1NiJ9.

Body:
{
"email":"my@email.com"
}

Received "Could not get any response".

ndroo · 2018-04-16T03:08:10Z

Yeah i get the same long pause...not sure whats up with that.

jmaxxz · 2018-04-22T02:33:31Z

@jdhrivas @ndroo

POST /validation/email

should have a body of:

{
"value":"{{email}}"
}

msutara · 2018-05-04T15:27:18Z

@jmaxxz
Man, first thank you for this work! Second, have you noticed that token returned recently seems not to "stick"? It works fine when both phone and email are validated, but (as I used mine with HomeBridge") when I restarted service and tried to use it again, I received 401. I think that August added an "aggree" to their authorization workflow, does it make sense?

this is decoded token I'm now getting with my homebridge plugin as well as your API ...

{
"installId":"E629CCCC-A9E0-40F1-8BB8-43A24830346B",
"applicationId":"",
"userId":"",
"vInstallId":true,
"vPassword":false,
"vEmail":true,
"vPhone":true,
"hasInstallId":true,
"hasPassword":true,
"hasEmail":true,
"hasPhone":true,
"isLockedOut":false,
"captcha":"",
"email":[
],
"phone":[
],
"expiresAt":"2018-09-01T15:21:11.015Z",
"LastName":"User",
"FirstName":"Anonymous"
}

jmaxxz · 2018-05-07T04:11:21Z

How are you updating the token you are using? As for as I can tell everything works as it did before. If you are using postman be sure you are setting the authorization token to be used after each step in the login process.

msutara · 2018-05-07T12:39:01Z

What I posted is decoded token returned from your API. I refresh/use returned token every time, same as your code does. It appears that token remains “anonymous”. I observed that subscribing August in different apps (like ifttt) ends with “agree” page, which is not what either of us do. Posibble that’s the one returning cache-able user token? Thanks!

jmaxxz · 2018-05-07T14:24:22Z

I don't have an API, the tools in this repo interact directly with August's servers.

msutara · 2018-05-07T14:29:08Z

Ok, sorry, my bad. I meant tools from your repo using August rest api are returning the token I posted.

jmaxxz · 2018-05-07T14:34:27Z

Post the raw token

jmaxxz · 2018-05-07T15:56:00Z

So it is not as you said, that token had a user id specified and works just fine. However, from the token I can tell that you did not follow the directions and verify your email address.

Verify your email address. I would use https://lostphone.august.com/ to invalidate the token you previously shared as it was a working token, and would grant access to your account.

jmaxxz · 2018-05-07T15:58:45Z

This was is the decoded contents of the token you posted. In pretty much every way this token is functional.

{
  "installId": "<REDACTED install id>",
  "applicationId": "",
  "userId": "<REDACTED user id>",
  "vInstallId": true,
  "vPassword": false,
  "vEmail": true,
  "vPhone": true,
  "hasInstallId": true,
  "hasPassword": true,
  "hasEmail": true,
  "hasPhone": true,
  "isLockedOut": false,
  "captcha": "",
  "email": [],
  "phone": [],
  "expiresAt": "2018-09-04T14:50:50.233Z",
  "LastName": "User",
  "FirstName": "Anonymous"
}

msutara · 2018-05-07T16:17:26Z

Thank you very much @jmaxxz! Apparently I was not able to sign in with phone number, only email when using iPhone app. After I "reset" my login as suggested, appears that token is now working as you said.

Thank you very much again!

jmaxxz · 2018-05-07T16:24:13Z

@msutara remember JWT tokens will grant access to your account, so be careful when you share them. I only asked for the raw token because in your previous post you said the userId was empty. (This would have been a very interesting token that was not specific to your account.)

Treat JWT tokens that are for your accounts as if they were your password.

msutara · 2018-05-07T16:25:40Z

Yes, I understood that, thanks for deleting that ...

federice · 2018-06-19T17:56:13Z

Hi Guys specially my friend @jmaxxz ! How did you manage to get the x-kease-api-key 14445b6a2dba it doesn't seems to be valid anymore.

jmaxxz · 2018-06-22T03:04:28Z

@federice use 79fd0eb6-381d-4adf-95a0-47721289d1d9

federice · 2018-06-22T03:14:28Z

Man you are a genius !!! How come you managed to get that so quickly ? it's working fine. Well done!! Many thanks

…

__________________ *Fabio Federice* *E*: fabio@federice.net

On Fri, 22 Jun 2018 at 00:04, Jmaxxz ***@***.***> wrote: @federice <https://github.com/federice> use 79fd0eb6-381d-4adf-95a0-47721289d1d9 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#5 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/Al2FMgWa_txp7XrXETIf-kG5N_WJXNa0ks5t_F6-gaJpZM4Q8SW0> .

jmaxxz · 2018-06-22T05:43:47Z

@federice simply capture traffic between the august app and their webservers.

The long form version:

Get yourself an old phone and install the august app on it.
Disable certificate validation system wide on your old phone. (Easier on Android than iOS)
Run mitm proxy on another machine
Configure your old phone with the proxy info from step 3.
Launch the app on your old phone
Mount lasers to sharks 🚥+ 🦈= 🌋

For most mobile apps or IoT things this is one of the best ways to get a practical understanding of how they work.

juancortez · 2018-12-15T00:08:26Z

I have been trying to get this to work but am stuck on the "validate" email or phone.

I posted /validation/email and got a valid code sent to my e-mail.

I tried posting this to the following validate/email.

{
"email":"email-addresss",
"code": "code-from-email"
}

and I am getting the following error in the body:

{
    "userId": "user-id",
    "_value": "email:email-address",
    "resolution": "token_incomplete"
}

Does anyone have any idea what I'm doing wrong? I am using the x-august-access-token from the validation/email response header.

Bhstark · 2020-05-05T00:36:50Z

This message is actually what you get when its working. You just copy the access token you get in response and use it in the rest of the API calls. The token is now considered valid

jmaxxz mentioned this issue Jan 24, 2018

Route to trigger two-factor email or text #4

Closed

jdhrivas closed this as completed Jan 28, 2018

Repository owner deleted a comment from msutara May 7, 2018

gary-reyes mentioned this issue Aug 8, 2018

Invalid API key snjoetw/py-august#6

Closed

wonderslug mentioned this issue Aug 10, 2018

API Key Not Valid mlamoure/Indigo-August-Home#4

Closed

jmaxxz mentioned this issue Jan 9, 2019

I have been trying to get this to work but am stuck on the "validate" email or phone. #7

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

How do you obtain valid x-august-api-key and x-kease-api-key #5

How do you obtain valid x-august-api-key and x-kease-api-key #5

jdhrivas commented Dec 9, 2017

jmaxxz commented Jan 24, 2018 •

edited

jmaxxz commented Jan 24, 2018 •

edited

jmaxxz commented Jan 27, 2018

jdhrivas commented Jan 28, 2018

jobryan commented Apr 5, 2018 •

edited

ndroo commented Apr 16, 2018

jmaxxz commented Apr 22, 2018 •

edited

msutara commented May 4, 2018

jmaxxz commented May 7, 2018

msutara commented May 7, 2018

jmaxxz commented May 7, 2018

msutara commented May 7, 2018

jmaxxz commented May 7, 2018

jmaxxz commented May 7, 2018 •

edited

jmaxxz commented May 7, 2018 •

edited

msutara commented May 7, 2018

jmaxxz commented May 7, 2018 •

edited

msutara commented May 7, 2018

federice commented Jun 19, 2018

jmaxxz commented Jun 22, 2018

federice commented Jun 22, 2018 via email

jmaxxz commented Jun 22, 2018 •

edited

juancortez commented Dec 15, 2018 •

edited

Bhstark commented May 5, 2020

How do you obtain valid x-august-api-key and x-kease-api-key #5

How do you obtain valid x-august-api-key and x-kease-api-key #5

Comments

jdhrivas commented Dec 9, 2017

jmaxxz commented Jan 24, 2018 • edited

jmaxxz commented Jan 24, 2018 • edited

jmaxxz commented Jan 27, 2018

jdhrivas commented Jan 28, 2018

jobryan commented Apr 5, 2018 • edited

ndroo commented Apr 16, 2018

jmaxxz commented Apr 22, 2018 • edited

msutara commented May 4, 2018

jmaxxz commented May 7, 2018

msutara commented May 7, 2018

jmaxxz commented May 7, 2018

msutara commented May 7, 2018

jmaxxz commented May 7, 2018

jmaxxz commented May 7, 2018 • edited

jmaxxz commented May 7, 2018 • edited

msutara commented May 7, 2018

jmaxxz commented May 7, 2018 • edited

msutara commented May 7, 2018

federice commented Jun 19, 2018

jmaxxz commented Jun 22, 2018

federice commented Jun 22, 2018 via email

jmaxxz commented Jun 22, 2018 • edited

juancortez commented Dec 15, 2018 • edited

Bhstark commented May 5, 2020

jmaxxz commented Jan 24, 2018 •

edited

jmaxxz commented Jan 24, 2018 •

edited

jobryan commented Apr 5, 2018 •

edited

jmaxxz commented Apr 22, 2018 •

edited

jmaxxz commented May 7, 2018 •

edited

jmaxxz commented May 7, 2018 •

edited

jmaxxz commented May 7, 2018 •

edited

jmaxxz commented Jun 22, 2018 •

edited

juancortez commented Dec 15, 2018 •

edited