Tesla API Token Generator

[HankLloydRight]

Hi Hank,
Will you update the script to handle the new process that Tesla has started to use?
https://tesla-api.timdorr.com/api-basics/authentication
BR,
Tom

Yeah, I saw that. I'll look into it, but not sure I have time currently.
All the tampermonkey code is open-source javascript if anyone else wants to take a crack at it.

 

[MrTemple]

Here's a working PHP script to locally generate your V3 Refresh Token:

**Working** PHP to Generate Refresh Token (Steps 1-4) · Discussion #288 · timdorr/tesla-api

 

[luckyj]

Is there a working script to get a new token? I tried teslascope/tokens and enode-engineering/tesla-oauth2 with no success. Disabled my MFA and still no success. Getting 403s. Yes, I am using the right password

 

[luckyj]

The PHP script MrTemple mentioned also didn't work, same issue noted by others on that page.

 

[luckyj]

Well this morning the Teslascope script worked, nothing changed on my end. Guess there was some maintenance or a problem last night.

 

[luckyj]

Hmmm. I got a token from the script but it doesn't seem to be working - getting 401s from API calls. New token seems really long, 870 bytes versus 68 bytes on my previous token.

Ugh, help! Anyone have a python script that gets a token, and then performs a command that works?

 

[Daniellane]

I’m assuming this iOS app still works.
https://apps.apple.com/us/app/tesla-token/id1411393432

 

[luckyj]

No iOS here, but thanks for the suggestion.

Sorry if I'm asking dumb questions, but I'm having a hard time figuring the new system out.

Does this look like the format of current tokens? (it's obfuscated a bit)

eyphbGckOkpSUzk1NkksknR5cCk6kkpXtCkskmtpZCk6km9UaDR1ZXNoM2tlZXptWDB1kn0.eyJpc3fiOipodHRwcbovLtr1dllbdlVbblEb7t9tLt9hdXRofi9tf7IsIfr1bCI6Ifh4dHBbOi8v7XV4aC54bXNs7S5pbt4vbtr1dll7L37bL3RvatVbIiwiaWr4IpoxNpE4NDA7ODE5LCpb73AiOlsib3BlbflkIiwibtbfbllbbV9h7tNlc3fiXSwiblr47SI6e7ptIpoifSIsIfr1bCI6Ifh4dHBbOi8vb3dbbXIt7XBpLnRlctxhbW94b3pbLfNvbS8iLCpbdWIiOipiODNhblE4fi437phlLTQwODAtOl7wN743OTliNpI7fbbxblIiLCpb73AiOlsib3BlbflkIiwibW1haWwiLCpvbfbsaW5lXtrp7tVbc7pdLCphenAiOipvdt5lcfrwaSIsIfrtciI6W7pwdtQiXSwi7XV4ar94aW1lIpoxNpE4NDA7ODE5rX4.lt7EaElel3cwldoNx7DH5tltcqqOXD8EbrQlarbWib7bApKrp3aaPn-At7twK7TrB7ElL4lEx7HrhvOxsprbqSblqrNeBQRH4elVWHDl7n9Aw1v6lhHx4a9RDfTbIo1oIpn1wS_4l96nf_palQlAbpA6Ca_r8dKCbWrSC7tlPbHp9Xd8bcefl77xXapRlt3Rerb53rhaQPrfOAf77d774h3wAbRPW5pDNbfbx98eItLNf7A8b5O7panPbdbXxQ7bbRppl7DRL9wqd4iWbBlxlvRplf7ofiI6Qkspbl7rRNVQSo1b7bl_hV88Db7ENSbkfrdlP4pfw46KIPRdSblklQ

 

[luckyj]

After reading Authentication a little more closely, that token above seems to be the JWT token that has to be exchanged per step 4. The teslascope script doesn't seem to do that. The enode-engineering one does, but I'm having trouble running it. So trying to use Postman, but at the moment I'm getting
{"error": "unsupported SSO app"}. Found a few places that suggest it could be a header issue. Still investigating...

 

[lgkahn]

if anyone comes up with a script or webpage that actually works let me know the one on teslafi works, but i really want to generate a token with a separate username and password to use in my home automation integration.

 

[luckyj]

Okay, I got the script from enode-engineering/tesla-oauth2 to work. Had to add --verbose to the command line otherwise there's a python error. And you have to save to a file with the -f option because the code that is printed to the console is NOT the access code.

 

[luckyj]

Looks like the code for the enode-engineering script was updated last night after I downloaded it. The --verbose is no longer needed, the issue looks like it was fixed. But -f is still needed.

Now the selenium python library is required, chromium-browser/chromedriver has to be installed, and libnss3 installed. And for me, sometimes it fails with "unknown error: DevToolsActivePort file doesn't exist", but running a little later works.

 

[luckyj]

Well I'm back to trouble this month in getting a token... 3 tools that I've found are not working for me right now:

1) enode-engineering/tesla-oauth2 gets

File "tesla.py", line 270, in <module>
    login(args)
  File "tesla.py", line 226, in login
    code = parse_qs(resp.headers["location"])["https://auth.tesla.com/void/callback?code"]
  File "/home/lucky/.local/lib/python3.8/site-packages/requests/structures.py", line 54, in __getitem__
    return self._store[key.lower()][1]
KeyError: 'location'

2) teslascope/tokens gets (even with headless option, no sandbox option, disable-dev-shm-usage option)

File "./auth.tokens.py", line 267, in <module>
    login(args)
  File "./auth.tokens.py", line 78, in login
    driver = create_driver()
  File "./auth.tokens.py", line 48, in create_driver
    driver = webdriver.Chrome('/home/lucky/t/chromedriver',options=options)
  File "/home/lucky/.local/lib/python3.8/site-packages/selenium/webdriver/chrome/webdriver.py", line 76, in __init__
    RemoteWebDriver.__init__(
  File "/home/lucky/.local/lib/python3.8/site-packages/selenium/webdriver/remote/webdriver.py", line 157, in __init__
    self.start_session(capabilities, browser_profile)
  File "/home/lucky/.local/lib/python3.8/site-packages/selenium/webdriver/remote/webdriver.py", line 252, in start_session
    response = self.execute(Command.NEW_SESSION, parameters)
  File "/home/lucky/.local/lib/python3.8/site-packages/selenium/webdriver/remote/webdriver.py", line 321, in execute
    self.error_handler.check_response(response)
  File "/home/lucky/.local/lib/python3.8/site-packages/selenium/webdriver/remote/errorhandler.py", line 242, in check_response
    raise exception_class(message, screen, stacktrace)
selenium.common.exceptions.WebDriverException: Message: unknown error: DevToolsActivePort file doesn't exist

3) **Working** PHP to Generate Refresh Token (Steps 1-4) · Discussion #288 · timdorr/tesla-api PHP script gets

array(2) {
  ["response"]=>
  string(17) "invalid_sso_token"
  ["refresh_token"]=>
  NULL
}

 

[luckyj]

I tried #1 and #2 on Windows and also failed. #1 same error. But, for #2 I was able to turn off headless and see the browser open. It got an access denied on the initial POST in Step 1 to https://auth.tesla.com/oauth2/v3/authorize, unsure why.

 

[3ngineer]

if anyone comes up with a script or webpage that actually works let me know the one on teslafi works, but i really want to generate a token with a separate username and password to use in my home automation integration.

I tried #1 and #2 on Windows and also failed. #1 same error. But, for #2 I was able to turn off headless and see the browser open. It got an access denied on the initial POST in Step 1 to https://auth.tesla.com/oauth2/v3/authorize, unsure why.

Have you guys tried this Postman Collection? It works great for me.

I posted a Postman solution for Step 1 to 4 (outlined excellently here). The Postman collection and environment are here. Reviewing the repository README.md is recommended. Feedback welcome!

Joe

 

[3ngineer]

Have you guys tried this Postman Collection? It works great for me.

Correction: WORKED great for me. Tried again on new computer and I can't even get step 1 working.
@JDOhio do you have any advice / info as to why step 1 isn't getting back the hidden elements (_csrf, _phase, etc.)? They aren't getting written to the environment and I don't see them in the response body anywhere.

 

[3ngineer]

if anyone comes up with a script or webpage that actually works let me know the one on teslafi works, but i really want to generate a token with a separate username and password to use in my home automation integration.

I tried #1 and #2 on Windows and also failed. #1 same error. But, for #2 I was able to turn off headless and see the browser open. It got an access denied on the initial POST in Step 1 to https://auth.tesla.com/oauth2/v3/authorize, unsure why.

Another option that works currently with near zero effort is RealCarvedArt/tesla-oauth2, discussed here. Thank you, @CarvedArt!

 

[AAKEE]

I’m assuming this iOS app still works.
‎Tesla Token

Thanks for the tip. Works fine 24Sept 2021), and needed a token generator that felt secure.

 

[blizzfire]

No, the "logout/delete token" simply logs your browser out of your account and deletes the token (and refresh token) stored as a browser cookie. It has no effect on the generated/displayed token which is still valid for other purposes. If you logout of my page and delete the browser cookie and then log back in again, you'll get a new token, but the old token will still be valid. If you want to delete all current valid tokens on your account, you would need to change your password on the Tesla website which should immediately expire all tokens.



The way I believe it works is that you:

1. request a new token
2. You get back a 'token' and a 'refresh token'
3. The token is valid for 45 days, you can then use that token on other API driven sites/services (like Teslafi.com)
4. If you want to expire that token (not all tokens), then you can click the "refresh token" button which will expire only that current token and give you a new token and refresh token good for another 45 days.



No, it only cancels the existing token paired with its refresh token and then generates a new pair.

Hello, I have a few questions here.

As mentioned, the access token expires once you request a new access token with a given refresh token.

1. Does and if so when does the refresh token expire? If it doesn’t that would mean that once refresh token has been obtained, it could indefinitely be used to generate access tokens (i.e. access the owner api).

2. Is there a place (Tesla website or Owner api call) that lists all active refresh tokens?

3. Is it possible to revoke all refresh tokens? What if you don’t have the list of all associated refresh tokens that have been generated?

Cheers

 

[HankLloydRight]

Hello, I have a few questions here.

As mentioned, the access token expires once you request a new access token with a given refresh token.

1. Does and if so when does the refresh token expire? If it doesn’t that would mean that once refresh token has been obtained, it could indefinitely be used to generate access tokens (i.e. access the owner api).

2. Is there a place (Tesla website or Owner api call) that lists all active refresh tokens?

3. Is it possible to revoke all refresh tokens? What if you don’t have the list of all associated refresh tokens that have been generated?

Cheers

Hello. The post of mine you quoted was from over two years ago, and I de-activated my Tesla Token generator almost that long ago. So I'm sorry, but I really can't answer your questions. I'd assume that it still holds if you change your tesla.com password, it will expire all existing tokens. And AFAIK, there is no place to see all active tokens.