search

TeslaBuds / AuthAppForTesla

54 stars 13 forks source link

Access Token vs Owners Token #9

Closed dacastro4 closed 3 years ago

dacastro4 commented 3 years ago

Hey! I'm recommending your app for iPhone users that want to sign in using their tokens in my Android watch app. I'm not familiar with your app 100% I just read a little bit of the code but one person try to use the Access Token and Refresh Token to sign in to my app and their tokens were the same, meaning refresh and access tokens were the same value.

According to your code, there's a way to get the "Owners token". Can you tell me how to do that so I can send it to my users?

Thank you so much!

Kemmey commented 3 years ago

Hey @dacastro4

The refresh token and access token exposed through the ui are not identical. But they do look similar, as they are both the proper v3 jwt tokens.

Tesla has moved to use only the v3 access tokens in the currently shipping official app, making it solely a question of time before the old v2 short access tokens are entirely deprecated.

You'll want to rewrite your apps authentication logic to accept the v3 refresh token, with which you can reissue as many access tokens as you need. V3 access tokens are now valid for 8 hour, but Tesla are actively adjusting this, so always stuck to the lifetime sent by the server when issuing tokens, and refresh ahead of time accordingly.

You should be able to see all this logic in the code.

I also have a .net Xamarin sample that runs on android if you're interested - though I know a proper android version has already been released on the play store.

For stop gap measures there an apple shortcuts action in the currently shipping build that exposes the old v2 owners token with 45 day lifespan. Users can create a new shortcut and add that action to gain access to it. But I highly recommend end against it, as Tesla are actively phasing it out.

Cheers,

Kim

dacastro4 commented 3 years ago

Thank you so much for your help. Did they change the endpoints or something?

I modified my code to accept the access token so I can generate the owner's token after that.

Kemmey commented 3 years ago

@dacastro4 For now everything works as it used to - but as with the transition from user/pass login to oauth, I believe it's only a matter of time before they reach critical mass of their own app rollout that they'll deprecate v2 endpoints and stop accepting owners tokens entirely. So better stay ahead and do the work now, than be sorry the day they shut it without warning :-D