Should we keep the proxy for login?

[alandtse]

We can either:

1. Keep the oauth proxy which requires a workaround and may break easily in the future.
2. Switch to only accepting a refresh token that has be generated by a third-party app. However, we are reliant on those being able to defeat Tesla's login security.

I do not intend to do both since it's the worst of both worlds.

Thoughts?

[jherby2k]

It's really up to you and what you're willing to maintain. Going with 2 could make it into the core integration right?

[alandtse]

No. Both are rejected by core and we're taking it out from core since there's no path forward without either.

[jherby2k]

Crummy. I'd say go with 2 and save yourself a recurring headache. Better to focus on features than login BS

[hbar98]

If you are going to do 1, then I'll work on getting logs. If you are going to do 2, then I won't worry about it right now.

I'm an utter neophyte at this level, so the only suggestion that I'd make is to go with whichever option that you can correct the fastest or easiest should something go wrong.

[omelhus]

I think the easiest way is to just use the refresh token and the external apps. The proxy will be a never ending game of cat and mouse.

[sillyfrog]

Re 2: I'm not sure how an external app works, but is it possible to get the tokens from an existing browser session? (eg: copy the relevant cookies?) Or even better, most browsers have copy as cURL or HAR, get these details, and paste them into an input box, and use python to parse out the relevant tokens (if it could work).

[omelhus]

You just use Auth App for Tesla on iOS or Tesla Tokens on Android to generate a token. It's really easy and the input in the config flow will just be the refresh token.

For the time being the sso tokens on the account page at tesla.com is using an old endpoint (v1) to generate the tokens and cannot be used to generate new v3 tokens.

[jameshiscott]

indeed, hence its super easy from an instructions on what to do for new uesrs

[ybizeul]

I'm down for the external app tokens, seems to be a reasonable alternative, considering how everyone seems to be committed in making it complicated.

[jameshiscott]

I would agree with option 2. The support level for new users is much lower than having to change host files etc

[nicholashead]

I believe tokens would be the best long-term thing. It may be worth working with https://github.com/adriankumpf/teslamate or other open source projects to see on the most "correct" way?

[alandtse]

Teslamate is using tokens now.

[omelhus]

Another benefit of using the token apps is that the issue with tokens is no longer a concern for the component, and many already rely on the token apps today.

The token app devs can focus on the auth and we can get heated steering wheels before winter👍

[hbar98]

I just want to be able to view my solar gateway in HA.

[alandtse]

Another benefit of using the token apps is that the issue with tokens is no longer a concern for the component, and many already rely on the token apps today.

The token app devs can focus on the auth and we can get heated steering wheels before winter👍

Yah let's go with tokens. Do you have time to get your PR into this repo? You'll just need to throw out the existing config flow and replace it. I won't have time until the weekend. The only caution may be the variables we save into the config entry are slightly differently named.

[omelhus]

I’ll see what I can do in the morning. Should be an easy fix.

[blair287]

I'm confused if other apps like tesla for wear os etc just need an email and password why is there such an issue for HA? When they are still all working OK.

[alandtse]

That's what the oauth proxy used to do, but I'm not interested in writing a mobile app to do that if someone else already did. We're either in the cat and mouse game or we're not.

There was a programmatic solution but it requires subscribing to the 2captcha service where you pay per catpcha solved. I am not interested in doing that because I find captcha solving services distasteful since I believe they're primary business is for cracking people's accounts in an automated fashion.

[blair287]

They're obviously smarter than those of us working in Python.

But assuming you're asking a serious question, all of the apps are trying to imitate Tesla's official apps because Tesla can't block their own apps. This includes requiring the app respond in certain ways including with technology designed to stop third party access. At a certain point, Tesla can tighten the controls so fake apps can't access the servers. From Tesla's perspective, we're the same as malware. The better question is why Tesla has taken this long to stop us.

It was a genuine query I was just wondering why it was such an issue with HA I didn't realise tesla doesn't like 3rd party apps I though they had a api for that reason.

Wasn't trying to be funny.

One of the reasons I bought a tesla was because I could automate things via HA.

[omelhus]

I’ve submitted a PR to @alandtse repo, so you’ll be back at automating your Tesla in no time 👍

[blair287]

I’ve submitted a PR to @alandtse repo, so you’ll be back at automating your Tesla in no time 👍

Will it require the integration to be reset up every month when the token expires?

Awesome work it's working now :)

[omelhus]

Will it require the integration to be reset up every month when the token expires?

Shouldn’t be necessary. It’s the same mechanism that keeps you logged into the app.