Skip to content

Commit

Permalink
Added more forceful communication and documentation for authenticatio…
Browse files Browse the repository at this point in the history
…n issues
  • Loading branch information
alexgolec committed Jul 12, 2020
1 parent 6ae5bf7 commit 8544523
Show file tree
Hide file tree
Showing 2 changed files with 17 additions and 4 deletions.
18 changes: 14 additions & 4 deletions docs/auth.rst
Original file line number Diff line number Diff line change
Expand Up @@ -162,9 +162,9 @@ probably never realize they've been sent to a malicious server, especially if
the landing page is designed to resemble the target API's landing page.

TD Ameritrade correctly prevents this attack by refusing to allow a login if the
redirect URI does not **exactly** match the redirect URI with which the app is
configured. If you make *any* mistake in setting your API key or redirect URI,
you'll see this instead of a login page:
redirect URI does not **exactly** match the client ID/API key and redirect URI
with which the app is configured. If you make *any* mistake in setting your API
key or redirect URI, you'll see this instead of a login page:

.. image:: _static/attempted-unauth-access.png
:width: 600
Expand All @@ -173,7 +173,17 @@ you'll see this instead of a login page:

If this happens, you almost certainly copied your API key or redirect URI
incorrectly. Go back to your `application list
<https://developer.tdameritrade.com/user/me/apps>`__ and copy-paste it again.
<https://developer.tdameritrade.com/user/me/apps>`__ and copy-paste the
information again. Don't manually type it out, don't visually spot-check it.
Copy-paste it. Make sure to include details like trailing slashes, ``https``
protol specifications, and port numbers.

Note ``tda-api`` *does not* require you to suffix your client ID with
``@AMER.OAUTHAP``. It will accept it if you do so, but if you make even the
*slightest* mistake without noticing, you will end up seeing this error and will
be very confused. We recommend simply passing the "Client ID" field in as the
API key parameter without any embellishment, and letting the library handle the
rest.


++++++++++++++++++++++++++++++++++++++++
Expand Down
3 changes: 3 additions & 0 deletions tda/auth.py
Original file line number Diff line number Diff line change
Expand Up @@ -93,11 +93,14 @@ def client_from_login_flow(webdriver, api_key, redirect_url, token_path,
'https://auth.tdameritrade.com/auth')

# Open the login page and wait for the redirect
print('\n**************************************************************\n')
print('Opening the login page in a webdriver. Please use this window to',
'log in. Successful login will be detected automatically.')
print()
print('If you encounter any issues, see here for troubleshooting: ' +
'https://tda-api.readthedocs.io/en/stable/auth.html' +
'#troubleshooting')
print('\n**************************************************************\n')

webdriver.get(authorization_url)

Expand Down

0 comments on commit 8544523

Please sign in to comment.