Enyaq: token exchange fails

[andig]

As of today for Enyaq:

########################################
#      Logging on to Skoda Connect     #
########################################
Initiating new session to Skoda Connect with s.stengel@gmx.de as username
INFO:skodaconnect.connection:Init Skoda Connect library, version 1.2.5
DEBUG:skodaconnect.connection:Using service https://msg.volkswagen.de
Attempting to login to the Skoda Connect service
2023-01-01 17:44:04.262910
INFO:skodaconnect.connection:Initiating new login
DEBUG:skodaconnect.connection:Starting authorization process for client skoda
DEBUG:skodaconnect.connection:Got redirect to signin-service
DEBUG:skodaconnect.connection:Start authorization for user ...
DEBUG:skodaconnect.connection:Found dynamic credentials form, extracting attributes
DEBUG:skodaconnect.connection:JSON: ...
DEBUG:skodaconnect.connection:Finalizing login
DEBUG:skodaconnect.connection:Received authorization code, exchange for tokens.
ERROR:skodaconnect.connection:An API error was encountered during login, try again later
Traceback (most recent call last):
  File "/Users/andig/htdocs/evcc/test.py", line 319, in <module>
    loop.run_until_complete(main())
  File "/opt/homebrew/Cellar/python@3.10/3.10.9/Frameworks/Python.framework/Versions/3.10/lib/python3.10/asyncio/base_events.py", line 649, in run_until_complete
    return future.result()
  File "/Users/andig/htdocs/evcc/test.py", line 154, in main
    if await connection.doLogin():
  File "/opt/homebrew/lib/python3.10/site-packages/skodaconnect/connection.py", line 136, in doLogin
    return await self._authorize('skoda')
  File "/opt/homebrew/lib/python3.10/site-packages/skodaconnect/connection.py", line 276, in _authorize
    raise SkodaException(f'Token exchange failed. Request status: {req.status}')
skodaconnect.exceptions.SkodaException: Token exchange failed. Request status: 400

I'm having the same issue in evcc-io/evcc#5647

Code/ID Token are received but exchange via POST https://tokenrefreshservice.apps.emea.vwapps.io/exchangeAuthCode fails:

HTTP/2.0 400 Bad Request
Content-Length: 76
Content-Type: application/json
Date: Sun, 01 Jan 2023 16:46:33 GMT

{"description":"Invalid identity token.","errorCode":"REQUEST_DATA_INVALID"}

The requets looks as I'd expect it.

[mortenf]

I can confirm this issue, I see the same error message.

[ronaldt80]

Same issue here, everything was working until today 2.30pm. Can confirm that the Skoda app works (including changing charge settings etc), also the Skoda website allows me to login and view the details of the vehicle (Enyaq iV60 with me3.0 software)

[thomas-merzenich]

Same for me with Superb iV:
skodaconnect.exceptions.SkodaException: Token exchange failed. Request status: 400

Skoda-App works as expected.

[Farfar]

Working on a solution but so far only native app seems to work and only newer versions (5.x+) which I haven't been able to intercept requests from.
Token exchange procedure seems to have changed and until I can get access to HTTP traces of recent app this issue will persist.
Or if VW Group reverses whatever change they implemented.

[RamonQu]

I'm using iPhone MySkoda-App version 5.2.7

The app does a really long list of calls which are performed when I enter my credentials in the app. Are there are specific calls you would like to see of the list below?

identity.vwgroup.io/signin-service/v1/
identity.vwgroup.io/oidc/v1/oauth/sso
identity.vwgroup.io/signin-service/v1/consent/users/
identity.vwgroup.io/oidc/v1/oauth/client/callback/success
api.connect.skoda-auto.cz/api/v1/authentication/token
api.connect.skoda-auto.cz/api/v1/users/
identity.vwgroup.io/oidc/v1/authorize
identity.vwgroup.io/oidc/v1/oauth/sso
identity.vwgroup.io/oidc/v1/oauth/client/callback
api.connect.skoda-auto.cz/api/v1/authentication/token
mbboauth-1d.prd.ece.vwg-connect.com
identity.vwgroup.io/oidc/v1/authorize
identity.vwgroup.io/oidc/v1/oauth/sso
identity.vwgroup.io/oidc/v1/oauth/client/callback
api.connect.skoda-auto.cz/api/v1/authentication/token
identity.vwgroup.io/oidc/v1/authorize
identity.vwgroup.io/oidc/v1/oauth/sso
identity.vwgroup.io/oidc/v1/oauth/client/callback
api.connect.skoda-auto.cz/api/v1/authentication/token
customer-profile.apps.emea.vwapps.io/v2/customers
api.connect.skoda-auto.cz/api/v2/preferences
api.connect.skoda-auto.cz/api/v1/vehicles-pre-registrations
api.connect.skoda-auto.cz/api/v3/garage
nc.skoda-connect.com/api/devices/register
sdrive.skod-auto.com

[RamonQu]

This looks the same as robinostlund/homeassistant-volkswagencarnet#411

There was a temporary workaround suggested with short live sessions. robinostlund/volkswagencarnet#184

[touraner]

The workaround is successful on my site. I can get the data from ma SEAT MII again. TNX

[andig]

@RamonQu are you able to trace the entire login sequence and potentially even the token refresh? Afaikt the api.connect.skoda-auto.cz/api/v1/authentication endpoint is new and would be of highest interest.

This seems to affect all brands. The same would then be true for VW and Seat- do they introduce similar (new) endpoints?

[andig]

See TA2k/ioBroker.vw-connect#225 for more structured attempt at fixing this.

[ronaldt80]

Did not update the integration in ha but it works as from 20 minutes ago. Noticed jedlix and stekker.app suddenly started working again. I guess VW/Skoda reverted their changes?

[Farfar]

Did not update the integration in ha but it works as from 20 minutes ago. Noticed jedlix and stekker.app suddenly started working again. I guess VW/Skoda reverted their changes?

Yes I suspect they got blowback from third party integrations (not unofficial ones like this library), smart charging vendors and such, that stopped working.
The only "proof" I have of this is that the old token exchange URL was still "working" only it responded with HTTP 400 Bad Request which indicates that it no longer accepted the information provided.
Also the MySkoda app version 5.2.7 on Android use different URLs for token exchange than the old versions of the app (3.x-4.x) which makes me believe the official apps have updates to handle tokens via brand specific servers instead of this "common" server for all brands and this change was indeed planned.

The change seems to be reverted though and all should be working as before. I have updated the library to 1.3.0 and moved token handling to the new URLs used in version 5.2.7 of the app so this library hopefully will continue working if/when VW Group decides to try implementing this change again.