Closed chrishubert closed 1 year ago
@chrishubert are you turn on the 2 layer protection? Can you share what function you used to get the response like that?
@mychaelgo I got this from POST /goid/token
And the option "Account Safety" -> "Two-Layer protection" is disabled in the Go-Jek app
I tried logout from the app, without success neither
@chrishubert
can you try?
POST https://customer.gopayapi.com/api/v1/users/pin/tokens
data
{
"challenge_id": "[YOUR gopay_challenge_id from goid token ]",
"client_id": "[RANDOM STRING]-MFAGOJEK",
"pin": "[YOUR 6 digits PIN]"
}
they changed the flow 😞
@mychaelgo I tried multiple random strings for the client_id
part without success
Thanks for your help by the way! I tried to MITM the app without success yet. 😅
i just try this flow yesterday & can't replicate it again 🤔 , i still can login without mfa
@mychaelgo I managed to pass the step by using a random HEXA String for x-uniqueid
& x-session-id
Headers
x-uniqueid: EEEEEEEE
x-session-id: EEEEEEEE
(Looks like I was using another session that was somehow flagged on their side) 🎉 Thanks for the help!
@mychaelgo I managed to pass the step by using a random HEXA String for
x-uniqueid
&x-session-id
Headersx-uniqueid: EEEEEEEE x-session-id: EEEEEEEE
(Looks like I was using another session that was somehow flagged on their side) 🎉 Thanks for the help!
Hi @chrishubert , would you mind to share how do you manage to pass the mfa ?
What I have done :
POST https://customer.gopayapi.com/api/v1/users/pin/tokens
with the mentioned data, but the result is "No Route matching".goid/token
but the response is goid:error:missing_field
What I found : some accounts are required and not required the challenge token, every account is 2fa disabled.
hope get some information from you or @mychaelgo . Thank you.
@pppokeran make sure you keep consistent x-uniqueid
& x-session-id
across requests. Keep it associated with phone number across multiple sessions
I ended up using the phone number itself for both headers and I went through without hitting the MFA
Thank you for your response, @chrishubert.
When an account connected, yes I kept them x-uniqueid
and x-session-id
associated with the account. But this MFA thing happened, same with your case, when getting access token and can not pass.
Every time I can not pass, I generate new x-uniqueid
and x-session-id
and I made it is different between previous generated ids (which every generated I record them) but still can not pass.
@pppokeran, have you tried using phone_number
value as content for x-uniqueid
and x-session-id
?
As well, confirm that "Account Safety" -> "Two-Layer protection" is turned off for the given account.
@chrishubert 🙏
putting phone_number
in header or in generated x-uniqueid
? Have not tried them yet.
Yes, I have made sure the "Two Layer protection" is turned off.
@chrishubert 🙏 putting
phone_number
in header or in generatedx-uniqueid
? Have not tried them yet. Yes, I have made sure the "Two Layer protection" is turned off.
@pppokeran I mean for the headers, you can use:
x-uniqueid: 81288888888
x-session-id: 81288888888
Where 81288888888
is the user phone number
Thanks @chrishubert for the response. I have tried and still not resolve this 2FA things.
I also tried decode the APK, and really appreciate @mychaelgo to have this API works. It is a headache or I can not decode properly (I used dex2jar).
and then I am trying the get access token with GoIdVerifyMFAOtpRequest
with data GoIdVerifyMfaOtpRequestData
from decoding the apk,
$payload = [
'client_id' => self::clientId,
'client_secret' => self::clientSecret,
'data' => [
'challenge_token' => $challenge_token,
'challenges' => [
[
"name" => "GoPay Pin 2FA",
"value" => $pin,
]
],
],
'grant_type' => 'challenge',
'scope' => [],
];
the result is Invalid JWT Token
then I assume maybe there is a way to get the token.
then, I found `TokenizePinRequest" inside the apk and can not get this class work. 😀
That's it. If both of you know how to get the token, it would be great. I'll get back after found something. 🙇
Hello!
Thanks for sharing the Swagger! I'm trying to use it as well for personal finance 👍 I receive a 403 Forbidden once I submit the OTP code:
Could you please share the endpoint to pass this step?