Allow passing poToken for unblock YouTube restrictions

[unixfox]

Describe your suggestion

Hello, Could you please add the ability to pass the poToken? Here is a JSON example:

{
   "videoId":"aaaaaaa",
   "context":{
      "client":{
      },
   "serviceIntegrityDimensions": {
        "poToken": "verylongstring"
    }
}

Like it's already possible to do it with visitor_data.

This will allow to "unblock" the YouTube restrictions on a blocked IP where YouTube returns Sign in to confirm you’re not a bot.

Thank you

Other details

https://github.com/iv-org/invidious/issues/4734

Checklist

• [X] I am running the latest version.
• [X] I checked the documentation and found no answer.
• [X] I have searched the existing issues and made sure this is not a duplicate.
• [X] I have provided sufficient information.

[ppalone]

Hi @unixfox, will poToken work with Android clients or does it only work with Web embedded clients?

[LuanRT]

@ppalone Unfortunately no. The PoToken on mobile is generated by a different VM, called DroidGuard. Web clients use BotGuard.

[kms0219kms]

Hi @unixfox and @LuanRT , is there any way to generate poToken without Selenium? The @unixfox 's implement for generator is simply get poToken by Selenium, which might not be work on youtubei.js/web.

[unixfox]

It's not selenium but https://github.com/ultrafunkamsterdam/nodriver. won't work with selenium see https://github.com/iv-org/youtube-trusted-session-generator/issues/2

[kms0219kms]

It's not selenium but ultrafunkamsterdam/nodriver. won't work with selenium see iv-org/youtube-trusted-session-generator#2

@unixfox Yeah, I just meant that it is kind of Selenium as it is automated browser driver. I want to get poToken without any browser drivers as it doesn't work on youtubei.js/web.

[retrouser955]

Yeah, I just meant that it is kind of Selenium as it is automated browser driver. I want to get poToken without any browser drivers as it doesn't work on youtubei.js/web.

As far as I know, only full-on browsers are able to generate potoken.

[kms0219kms]

Yeah, I just meant that it is kind of Selenium as it is automated browser driver. I want to get poToken without any browser drivers as it doesn't work on youtubei.js/web.

As far as I know, only full-on browsers are able to generate potoken.

@retrouser955 Yep, I am just curious that HOW youtube embed client generates poToken? There is no sense for generating poToken by magic in full-on browsers.....

[kane50613]

How long will the token be able to live? Do I need to have a cron job to keep rotating it?

[kane50613]

It still says "Sign in to confirm you’re not a bot" after providing visitor_data and po_token generated on the machine with the same IP.

Edit: I forgot to use the GitHub version, now it says "Watch on the latest version of YouTube."

[JellyBrick]

~It still says "Sign in to confirm you’re not a bot" after providing visitor_data and po_token generated on the machine with the same IP.~

Edit: I forgot to use the GitHub version, now it says "Watch on the latest version of YouTube."

I can reproducible it too.

{
  info: {
    status: 'ERROR',
    reason: 'This video is unavailable',
    embeddable: false,
    audio_only_playablility: null,
    error_screen: PlayerErrorMessage {
      type: 'PlayerErrorMessage',
      subreason: Text {
        runs: [
          TextRun {
            text: 'Watch on the latest version of YouTube.',
            bold: false,
            italics: false,
            strikethrough: false,
            endpoint: [NavigationEndpoint],
            attachment: undefined
          }
        ],
        text: 'Watch on the latest version of YouTube.',
        endpoint: NavigationEndpoint {
          type: 'NavigationEndpoint',
          payload: {
            url: 'market://details?id=com.google.android.youtube&url=https%3A%2F%Fwww.youtube.com%2Fwatch%3Fv%3DswVEesI3StM',
            target: 'TARGET_NEW_WINDOW'
          },
          metadata: {
            url: 'market://details?id=com.google.android.youtube&url=https%3A%2F%Fwww.youtube.com%2Fwatch%3Fv%3DswVEesI3StM',
            page_type: 'WEB_PAGE_TYPE_UNKNOWN',
            api_url: undefined
          }
        }
      },
      reason: Text {
        runs: [
          TextRun {
            text: 'The following content is not available on this app.',
            bold: false,
            italics: false,
            strikethrough: false,
            attachment: undefined
          }
        ],
        text: 'The following content is not available on this app.'
      },
      proceed_button: null,
      thumbnails: [
        Thumbnail {
          url: '//s.ytimg.com/yts/img/meh7-vflGevej7.png',
          width: 140,
          height: 100
        },
        Thumbnail {
          url: '//s.ytimg.com/yts/img/meh7-vflGevej7.png',
          width: 140,
          height: 100
        }
      ],
      icon_type: 'ERROR_OUTLINE'
    }
  },
  date: 2024-08-20T14:18:21.711Z,
  version: '10.3.0'
}

[mooleshacat]

As far as I know, only full-on browsers are able to generate potoken.

YunzheZJU/youtube-po-token-generator

I am not sure if you have seen this repo, but apparently this person can obtain the visitor_data with one request and then without opening a web browser or making another request they somehow calculate what the po-token is. The problem is it is in nodeJS I believe.

If this is true I think it would cut back some of the traffic and speed things up on busy instances.

[kms0219kms]

As far as I know, only full-on browsers are able to generate potoken.

YunzheZJU/youtube-po-token-generator

I am not sure if you have seen this repo, but apparently this person can obtain the visitor_data with one request and then without opening a web browser or making another request they somehow calculate what the po-token is. The problem is it is in nodeJS I believe.

If this is true I think it would cut back some of the traffic and speed things up on busy instances.

Yep, I have seen this repo and added this code to my service.

[retrouser955]

As far as I know, only full-on browsers are able to generate potoken.

YunzheZJU/youtube-po-token-generator

I am not sure if you have seen this repo, but apparently this person can obtain the visitor_data with one request and then without opening a web browser or making another request they somehow calculate what the po-token is. The problem is it is in nodeJS I believe.

If this is true I think it would cut back some of the traffic and speed things up on busy instances.

Yes I think I know how youtube generates po tokens now. It is by using botguard. See, botguard gives you a challenge that only a "browser" (heavy quote on quotes) can solve and if you successfully solve this, they will return a trusted token to you. You can find a deeper analysis on https://github.com/LuanRT/BgUtils

[mooleshacat]

It is by using botguard.

Correct I've heard others talking about BotGuard and DroidGuard. The only question is, can this be implemented directly into Invidious, or into one of the po-token generators?

I've been trying myself to make the code work over http proxy to my VPN, because the other code seems to be "dirty" to me as it opens a web browser to get the tokens, which costs ram, speed, bandwidth, and time. My problem is I have no idea what I am doing, and this is in a language I do not understand even on a basic level (nodejs)

Are there any repos that use this method that can be implemented while we wait for Invidious to provide their solution?

[retrouser955]

The repo I have provided allows you with is to the codebase for a package that allows you to get the PoToken without the use of a browser. Check it's examples for more info.

[SajjadSarwarPK]

Can someone please help me to understand, I have passed the po token and visitor data. it asks me to authenticate and then it started returning the video download urls on a flask service. But problem is that those urls can only be downloaded on that cloud machine not on local machine. Can someon please guide to get red of that in case of PO_Token is being used?