Disable 2FA for API access

[feikede]

There's no pint in having a bot collect my 2FA e-mail - not funny.
Pls. provide something like a bot flag in SignInMutation to skip 2FA and make it possible to login like before yesterday.

Or - if you don't want us to program bots against your API - Please clarify that.

Thanks!

[Vinedine]

There is no need for such a flag. You actually mentioned the solution in #14 . Is it possible then to close this issue?

[feikede]

The flag would be more comfortable. It's not so easy to fetch the 2FA code from the e-mail with a bot. Also, the format of the 2FA mail can change ... then the bot will again fail to connect.

[Vinedine]

Sorry I misunderstood your question.

You do not need to fetch it from the e-mail.

If you are using C# you can use a library like Otp.NET and do something like this;

// Convert the seed to a byte array
var otpKeyBytes = Base32Encoding.ToBytes(twoFactorAuthSeed);

// Instanticate the generator's class
var totp = new Totp(otpKeyBytes);

// Compute the 2FA code. Easy.
var twoFactorCode = totp.ComputeTotp();

Whatever language you are programming in I guess there will be a similar library.

[feikede]

Thanks, one last question... in your example, the "twoFactorAuthSeed" - is it the otp_session_challenge from the initial GQL SignIn? Thanks!

[jeremoquai]

Hello.
Any code snippet in Python for a newbie ? ;-)
Thanks lot !

[jeremoquai]

@Vinedine ?

[Vinedine]

@feikede twoFactorAuthSeed is the Seed Key of the QR Code. You can find out what this value is by using a QR Code app.
Scan the QR code and then you will see the Seed Key in the URL.

@jeremoquai There is an example in python in #12. I do not develop in Python so cannot really help you more than that.

[feikede]

Here's a code snippet for the 2FA step in PHP (you'll need to require spomky-labs/otphp for TOTP and guzzlehttp/guzzle as http-client)

      $secret = 'XXXXXXXXXXXXXXXXXXXXXXXX';
      $otp = TOTP::create($secret);
      $userCode = $otp->now();
      $otpCode = trim($userCode);
      $payload = ['input' => ['otpAttempt' => $otpCode, 'otpSessionChallenge' => $otpSessionChallenge, 'gaClientId' => "8888888888.9999999999"]];
      $query = file_get_contents('gql/SignInMutation_Step2.gql');
      $gql = ['operationName' => 'SignInMutation', 'variables' => $payload, 'query' => $query];
      $response = $this->client->request('POST', $this->endpoint, ['json' => $gql, 'headers' => $this->headers]);
      $code = $response->getStatusCode();
      if ($code != 200) {
        throw new Exception('Could not signIn');
      }

You'll find SignInMutation_Step2.gql in https://api.sorare.com/graphql/playground

[wti3pvs]

Hi all,
thanks for your discussion and helpful instructions. I have also put the service key from the qr code into the secret variable of feikede's php code above. However the generated otpCode is not accepted. What might be wrong? OptCode and the code shown by my FSA app must be the same, correct?
Thanks in advance for any suggestion!

[feikede]

Yes, the codes otp and your FSA should match, it's deterministic. Could be a time issue. Try checking time and timezone on your computer?

[wti3pvs]

Ok, solved my issue. The service key is equal to the secret. So I had not to do any base32 encoding.