Users randomly receiving "User revoked consent" 401 errors

[stx]

Some users are (randomly?) receiving "User revoked consent" 401 errors whenever their access token is refreshed. This is happening multiple times a day, and it forces them to reauthorize their account over and over again - but the reauthorizations are automatic and do not prompt them for consent, so consent has not actually been revoked.

They claim they are not altering their Tesla account in any way and have no other apps or services running.

Here is an example Tesla OAuth response:

HTTP 401
{"error":"login_required","error_description":"User revoked consent","error_uri":"https://auth.tesla.com/error/reference/c9e8ec46-74d8-4eb1-9ff1-caab349db462-1705012163951"}

[stx]

Found this happening with some more Tesla customers.

Appears like it might be isolated to Europe.

Adding MFA, changing passwords, resetting apps/services doesn't help. "User revoked consent" is happening for them every 8 hours as the token refreshes.

[sapkra]

I think the problem happens if a user who is signing in is registered in another region than the partner account. My partner account is in the EU but NA users are getting exactly this error.

After changing the region from one account from NA to EU everything works fine for this account.

[stx]

I think the problem happens if a user who is signing in is registered in another region than the partner account. My partner account is in the EU but NA users are getting exactly this error.

After changing the region from one account from NA to EU everything works fine for this account.

@sapkra It sounds like you found a solution to this, but I don't follow. What do you mean you changed the region?

[sapkra]

You can move a user to EU servers (the region of the account) in the account settings on the Tesla Website. As a developer you should know how because it's disabled for some reason to "normal" users.

[stx]

You can move a user to EU servers (the region of the account) in the account settings on the Tesla Website. As a developer you should know how because it's disabled for some reason to "normal" users.

@sapkra Weird, I can't find this setting anywhere on either user or developer accounts. Can you post a URL and screenshot of this setting?

[sapkra]

https://accounts.tesla.com/account-settings/personal-information/edit-basic-information

PS: in my case I needed the developer console to change the region ;)

[sapkra]

Here the full explanation how to change the region:

1. Go to the page Account Settings and click on "Edit Basic Information"
2. Make "Inspect element" on the region select input.
3. Remove disabled and add a new option with the value of your region e.g. DE for Germany.
4. You can now select the new region and language in the user interface and save the changes.

[jaggerc]

I am getting the same when refreshing a token. Data calls work fine until the token expires.

HTTP 401
{"error":"login_required","error_description":"User revoked consent"

It's only for eu users. We are registered in the US.

We have tried every combination of things to change when registering an eu user but still get stuck on the refresh not working. Unfortunately we cannot ask every user to go in and change their region in developer mode.

Did anyone figure this issue out?

[stx]

I'm receiving hundreds of emails about this and really am not sure what to tell people. I have tried pretty much everything imaginable.

[jpgough]

+1 I’m one of those people emailing @stx as a user. This needs to be fixed, as it’s clearly not implementing the OAuth2 standard correctly from a user perspective.

My region is set to UK. Any further details that help I’m happy to help supply.

[itsMeDavidV]

Can confirm we are seeing many cases of this. This should be treated as critical @sethterashima

[dmitrybirin]

Hello! 👋 We are using fleet api and now start experience the same problem.
We're based in EU. Around half of our users in EU experience problems, so we're not see correlation with the region. Like @stx said in original post it seems to be random.

Would appreciate any feedback from Tesla, but support haven't responding to our emails.

[sp00nsthlm]

Hey!

I have this problem with one of my two 3rd party apps, the Smart charging at home connected to my electricity company "Tibber" works perfectly but the Tessie app (for driving record) logs out after exactly 8 hours. Very surprising as I need it for accounting of the car's private versus service miles. Do we know if anyone is working on a solution?

[kevin39]

Same here. Tessie logout every 8h. very annoying :(
Didn't found any working workaround.

[bassmaster187]

It happen to me as well. My wifes car was for any reason in region "US". After moving it to "EU" / German account as described by
@sapkra it works now. Please Tesla fix the bug!

[sp00nsthlm]

It happen to me as well. My wifes car was for any reason in region "US". After moving it to "EU" / German account as described by @sapkra it works now. Please Tesla fix the bug!

My account is locked to my country sweden and i can't choose any other? i did however put in my home adress, se if that will change the fault...

[fabianhu]

Did you define the scope "offline_access" at registration and did the token refresh work?
offline_access enables token refresh without another login by the customer.
Token expiry time is 8h.

I don't know much about the Go technique refreshing tokens, but my python implementation kind of works.
Hope this helps.

[jpgough]

@stx I'm not sure if this helps, or is just random. As has been usual over the past few days Tessie kicked me out yesterday and asked for an access token. However this time I happened to be in a private browser on Safari on iOS. I had to log back in with username, password, authenticator code.

Since I've done this I've not been kicked out again (I was expecting that to have happened this morning and yesterday afternoon).

[stx]

It appears that Tesla has rolled out an auth system update with a new refresh token format, and this problem seems to be fixed now judging from the experience of several users. Can anyone else confirm this issue has been resolved for them as well before I close this?

[itsMeDavidV]

@stx No, I'm still seeing frequent cases of login_required. I'd hold off on closing this.

[KonradGridio]

We see that Tesla updated refresh_token structure yesterday. Which means all fleet_api token refreshes failed (401 login required - our entire fleet on those), but then after customers log in again, then everything works and the original 401 Error Revoked problem disappears.

So a heavy-handed fix it seems, but did the trick. Now just have to get all our drivers to re-connect :(.

[sp00nsthlm]

Hi, mine seems to have been working since yesterday, had an update to the Tesla app from the App-store in my phone, but so far it's been working and I'm hopeful now. But eagerly waiting for it to crash again…

[jaggerc]

Just out of curiosity, where are you seeing that Tesla updated the token refresh system? Are they publishing a log somewhere?

[Chrophe]

Hi, I don't have to log in to Tesla since yesterday as well. I switched my connectivity in Tessie account yesterday and I had to log in again with my ID and 2FA. No problem anymore.

[kevin39]

No logout anymore on my side since +30h ago. That never happened.
Maybe the issue is solved ?

[sp00nsthlm]

I still see problems with registration of runs, last run was registered int but the app is stuck in idle... despite several restarts

[sp00nsthlm]

How difficult would it be for tesla to create a driving journal themselves to keep track of their private vs business miles, with the option to save as an excel file? then we wouldn't have this problem...

[ThomasAlxDmy]

Hey all we've now upgraded the system, this bug should be resolved. Thank you for the feedback to chase this down!

[stx]

@ThomasAlxDmy

Thanks for confirming. I believe those still having issues are running into the new change that refresh tokens can no longer be used twice: #160.