Unauthorized using Tesla Fleet API directly

[TomasCorral]

Is there an existing issue for this?

• [X] I have searched the existing issues

What happened?

I am trying to make the change to Tesla Fleet API like the docs say. Everything used to work with the old API. I already have a developer Tesla account with client id and secret. Hosted public key. Proxy working for HomeAssistant Tesla Integration and everything works fine.

My interpretation of the docs at https://docs.teslamate.org/docs/guides/api#tesla-fleet-api is that I only need to change TESLA_AUTH_CLIENT_ID which I did. It says to "Add the following environment variable with your own domain" but then does not say which one.

I used the following configuration:

• TESLA_API_HOST=https://fleet-api.prd.eu.vn.cloud.tesla.com
• TESLA_AUTH_HOST=https://auth.tesla.com
• TESLA_AUTH_PATH=/oauth2/v3
• TESLA_AUTH_CLIENT_ID=my-client-id-from-tesla

When I initialize I get the logs that i'm putting here.

Expected Behavior

Steps To Reproduce

1. Working instalation of teslamate using old API
2. Changed to FleetAPI like the docs say
3. Error 401 unauthorized

Relevant log output

Attaching to teslamate-database-1, teslamate-teslamate-1
teslamate-database-1   | 
teslamate-database-1   | PostgreSQL Database directory appears to contain a database; Skipping initialization
teslamate-database-1   | 
teslamate-database-1   | 2024-07-11 23:04:15.807 UTC [1] LOG:  starting PostgreSQL 14.12 (Debian 14.12-1.pgdg120+1) on x86_64-pc-linux-gnu, compiled by gcc (Debian 12.2.0-14) 12.2.0, 64-bit
teslamate-database-1   | 2024-07-11 23:04:15.808 UTC [1] LOG:  listening on IPv4 address "0.0.0.0", port 5432
teslamate-database-1   | 2024-07-11 23:04:15.808 UTC [1] LOG:  listening on IPv6 address "::", port 5432
teslamate-database-1   | 2024-07-11 23:04:15.812 UTC [1] LOG:  listening on Unix socket "/var/run/postgresql/.s.PGSQL.5432"
teslamate-database-1   | 2024-07-11 23:04:15.821 UTC [27] LOG:  database system was shut down at 2024-07-11 23:02:26 UTC
teslamate-database-1   | 2024-07-11 23:04:15.828 UTC [1] LOG:  database system is ready to accept connections
teslamate-teslamate-1  | 2024-07-11 23:04:17.438 [info] Migrations already up
teslamate-teslamate-1  | 2024-07-11 23:04:19.749 [info] No tzdata release files found in custom data dir. Copying release file from tzdata priv dir.
teslamate-teslamate-1  | 2024-07-11 23:04:19.889 [info] System Info: Erlang/OTP 26 (jit)
teslamate-teslamate-1  | 2024-07-11 23:04:19.889 [info] Version: 1.30.0
teslamate-teslamate-1  | 2024-07-11 23:04:20.369 [info] POST https://auth.tesla.com/oauth2/v3/token -> 200 (430.761 ms)
teslamate-teslamate-1  | 2024-07-11 23:04:20.370 [info] Refreshed api tokens
teslamate-teslamate-1  | 2024-07-11 23:04:20.376 [info] Scheduling token refresh in 6 h
teslamate-teslamate-1  | 2024-07-11 23:04:20.385 [info] Running TeslaMateWeb.Endpoint with cowboy 2.10.0 at :::4000 (http)
teslamate-teslamate-1  | 2024-07-11 23:04:20.386 [info] Access TeslaMateWeb.Endpoint at http://localhost
teslamate-teslamate-1  | 2024-07-11 23:04:20.559 [info] GET https://fleet-api.prd.eu.vn.cloud.tesla.com/api/1/products -> 401 (172.994 ms)
teslamate-teslamate-1  | 2024-07-11 23:04:20.560 [info] Refreshing access token ...
teslamate-teslamate-1  | 2024-07-11 23:04:20.560 [warning] Could not get vehicles: :unauthorized
teslamate-teslamate-1  | 2024-07-11 23:04:20.564 [warning] Using fallback vehicles:
teslamate-teslamate-1  | 
teslamate-teslamate-1  | [
teslamate-teslamate-1  |   %TeslaApi.Vehicle{
teslamate-teslamate-1  |     id: REMOVED_ID_1,
teslamate-teslamate-1  |     vehicle_id: REMOVED,
teslamate-teslamate-1  |     vin: "REMOVED",
teslamate-teslamate-1  |     tokens: [],
teslamate-teslamate-1  |     state: "unknown",
teslamate-teslamate-1  |     option_codes: [],
teslamate-teslamate-1  |     in_service: false,
teslamate-teslamate-1  |     display_name: "Tesla-02",
teslamate-teslamate-1  |     color: nil,
teslamate-teslamate-1  |     calendar_enabled: nil,
teslamate-teslamate-1  |     backseat_token: nil,
teslamate-teslamate-1  |     backseat_token_updated_at: nil,
teslamate-teslamate-1  |     api_version: nil,
teslamate-teslamate-1  |     charge_state: nil,
teslamate-teslamate-1  |     climate_state: nil,
teslamate-teslamate-1  |     drive_state: nil,
teslamate-teslamate-1  |     gui_settings: nil,
teslamate-teslamate-1  |     vehicle_config: nil,
teslamate-teslamate-1  |     vehicle_state: nil
teslamate-teslamate-1  |   },
teslamate-teslamate-1  |   %TeslaApi.Vehicle{
teslamate-teslamate-1  |     id: REMOVED_ID_2,
teslamate-teslamate-1  |     vehicle_id: REMOVED,
teslamate-teslamate-1  |     vin: "REMOVED",
teslamate-teslamate-1  |     tokens: [],
teslamate-teslamate-1  |     state: "unknown",
teslamate-teslamate-1  |     option_codes: [],
teslamate-teslamate-1  |     in_service: false,
teslamate-teslamate-1  |     display_name: "Tesla-01",
teslamate-teslamate-1  |     color: nil,
teslamate-teslamate-1  |     calendar_enabled: nil,
teslamate-teslamate-1  |     backseat_token: nil,
teslamate-teslamate-1  |     backseat_token_updated_at: nil,
teslamate-teslamate-1  |     api_version: nil,
teslamate-teslamate-1  |     charge_state: nil,
teslamate-teslamate-1  |     climate_state: nil,
teslamate-teslamate-1  |     drive_state: nil,
teslamate-teslamate-1  |     gui_settings: nil,
teslamate-teslamate-1  |     vehicle_config: nil,
teslamate-teslamate-1  |     vehicle_state: nil
teslamate-teslamate-1  |   }
teslamate-teslamate-1  | ]
teslamate-teslamate-1  | 2024-07-11 23:04:20.564 [info] Starting logger for 'Tesla-02'
teslamate-teslamate-1  | 2024-07-11 23:04:20.577 [info] Starting logger for 'Tesla-01'
teslamate-teslamate-1  | 2024-07-11 23:04:20.637 [info] GET https://fleet-api.prd.eu.vn.cloud.tesla.com/api/1/vehicles/REMOVED_ID_1 -> 401 (51.268 ms)
teslamate-teslamate-1  | 2024-07-11 23:04:20.638 car_id=2 [error] Error / :unauthorized
teslamate-teslamate-1  | 2024-07-11 23:04:20.676 [info] MQTT connection has been established
teslamate-teslamate-1  | 2024-07-11 23:04:20.749 [info] GET https://fleet-api.prd.eu.vn.cloud.tesla.com/api/1/vehicles/REMOVED_ID_2 -> 401 (162.046 ms)
teslamate-teslamate-1  | 2024-07-11 23:04:20.750 car_id=1 [error] Error / :unauthorized
teslamate-teslamate-1  | 2024-07-11 23:04:20.828 [info] POST https://auth.tesla.com/oauth2/v3/token -> 200 (267.839 ms)
teslamate-teslamate-1  | 2024-07-11 23:04:20.830 [info] Scheduling token refresh in 6 h
teslamate-teslamate-1  | 2024-07-11 23:04:20.830 [info] Refreshing access token ...

Screenshots

No response

Additional data

No response

Type of installation

Docker

Version

v.130.0

[TomasCorral]

Since I did not fully understood what should I change to my own domain I also tried:

TESLA_API_HOST=https://myproxy.mydomain.com TESLA_AUTH_HOST=https://auth.tesla.com/ TESLA_AUTH_PATH=/oauth2/v3 TESLA_AUTH_CLIENT_ID=my-client-id-from-tesla

I also have one access_token that I am using to test Tesla Http Proxy.

[JakobLichterfeld]

It says to "Add the following environment variable with your own domain" but then does not say which one.

The env variables needed to set are displayed in the box... named # API Fleet

see also: https://github.com/teslamate-org/teslamate/discussions/3959

[TomasCorral]

But it is not stated witch ones and to what.

Breaking down what I choose: TESLA_AUTH_CLIENT_ID=my-client-id-from-tesla (correctly set to my id) TESLA_AUTH_HOST=https://auth.tesla.com/ TESLA_AUTH_PATH=/oauth2/v3

TESLA_API_HOST I assume this is the one that I need to change for my own domain but also there is a line saying: Use the correct region in the TESLA_API_HOST field thats why I tried both my own http proxy and https://fleet-api.prd.eu.vn.cloud.tesla.com/

[JakobLichterfeld]

But it is not stated witch ones and to what.

https://docs.teslamate.org/docs/configuration/environment_variables

[JakobLichterfeld]

Use the correct region

Just click the link, highlighted in green https://developer.tesla.com/docs/fleet-api#endpoints-and-regional-requirements

Or just read https://docs.teslamate.org/docs/guides/api#tesla-fleet-api where it is directly explained

[adampetrovic]

I have to agree. It's not very clear, and I don't think it's actually possible for the standard case. The docs don't really speak to using a custom proxy. Only to using the official, publically available telemetry fleet API.

For those that host their own proxy locally, changing the TESLA_API_HOST field to point to that proxy makes sense, but unless it's on a publically hosted domain with a valid SSL certificate the connection will fail as there is no provision to specify a user-signed SSL certificate

              TESLA_API_HOST: https://tesla-proxy-app.automation.svc.cluster.local:8099
              TESLA_AUTH_HOST: https://auth.tesla.com
              TESLA_AUTH_PATH: /oauth2/v3

yields

2024-07-13 06:52:49.005 [notice] TLS :client: In state :wait_cert_cr at ssl_handshake.erl:2127 generated CLIENT ALERT: Fatal - Handshake Failure
 - {:bad_cert, :hostname_check_failed}
2024-07-13 06:52:49.005 [error] GET https://tesla-proxy-app.automation.svc.cluster.local:8099/api/1/vehicles/<redacted> -> error: "TLS client: In state wait_cert_cr at ssl_handshake.erl:2127 generated CLIENT ALERT: Fatal - Handshake Failure\n {bad_cert,hostname_check_failed}" (8.280 ms)

The Custom Tesla Homeassistant integration supports Tesla Fleet Proxies for provides for this, for example:

[TomasCorral]

@JakobLichterfeld then my config is right and it is what should be used. The issue mantains and my doubts about which urls should I put in each env variable are gone. They way I read the docs is teslamate does all the fleet api job but I expected it would use the proxy, specially when MyTeslaMate configurarion changes those variables to use MyTeslaMate proxy. That made me think I also needed to use my own proxy.

@adampetrovic thats what I was thinking teslamate wanted, us to setup the proxy like home assistant integration. Thats why I tried both urls int config. I actually have a proxy working with a lets encrypt certificate but only opened to my local network although I would prefer a self signed one for this matter too. #3979 is about the self signed certificate issue.

[JakobLichterfeld]

@JakobLichterfeld then my config is right

If your config is right, where is your issue?

They way I read the docs is teslamate does all the fleet api job

You should really reread the docs. TeslaMate does not use the FleetAPI in any kind, as it has many drawbacks. There is a way to use the Fleet API endpoints and still use TeslaMate, that's what the doc from @jlestel is talking about.

[JakobLichterfeld]

 starting PostgreSQL 14.12

btw. your Postgres should be updated --> https://docs.teslamate.org/docs/maintenance/upgrading_postgres

[TomasCorral]

So after I setup env variables like the docs say I get 401 error while accessing car data. All this config discussion was because even reading the docs I was not sure how to proceed, like @adampetrovic agreed it was not very clear. Thats why I said that I tried to test, before creating the issue, the 2 configs that I took away by reading the documentation.

[jlestel]

The documentation does not explain how to obtain tokens with the Fleet API, but to be authenticated by the Fleet API, you need to obtain tokens as with the legacy API.

The endpoint to obtain the initial tokens: https://developer.tesla.com/docs/fleet-api#third-party-token

Indeed, if your tokens are not valid, the return code is 401.

[TomasCorral]

I tried to use tokens generated via Tesla HTTP Proxy HomeAssistant Addon, they generate the tokens. It failed on teslamate UI

[cmilanf]

I am facing the very same issue, if I configure TeslaMate to use the Fleet API, I get a 401 when calling to https://auth.tesla.com/oauth2/v3. Steps I have followed:

1. I added the following env variables to the Docker container:

   TESLA_API_HOST=https://fleet-api.prd.eu.vn.cloud.tesla.com
   TESLA_AUTH_HOST=https://auth.tesla.com
   TESLA_AUTH_PATH=/oauth2/v3
   TESLA_AUTH_CLIENT_ID=my-client-id

2. I get the OAuth authorization code calling https://auth.tesla.com/oauth2/v3/authorize.
3. Then, I use the code to get the access and refresh tokens via https://auth.tesla.com/oauth2/v3/token.
4. But when I am to use the tokens in the TeslaMate login, I get a 401 in the logs and Invalid token in the application.

I have tested the tokens via simple cURL calls and they are working as expected, so it looks like something is off.

Configuring TeslaMate via Owner API works well.

[TomasCorral]

It happens the same with me when I try to put the tokens that work with Home Assistant integration and via curl. If I log out and try to use the codes it doesnt work.When I change from owner’s api to Tesla Fleet API I get 200 from auth.tesla and 401 from fleet api.

[cmilanf]

It happens the same with me when I try to put the tokens that work with Home Assistant integration and via curl. If I log out and try to use the codes it doesnt work.When I change from owner’s api to Tesla Fleet API I get 200 from auth.tesla and 401 from fleet api

That's right, the tokens I get from the explained procedure work well when using the Home Assistant integration in Fleet API mode.

[yangiak]

It happens the same with me when I try to put the tokens that work with Home Assistant integration and via curl. If I log out and try to use the codes it doesnt work.When I change from owner’s api to Tesla Fleet API I get 200 from auth.tesla and 401 from fleet api

That's right, the tokens I get from the explained procedure work well when using the Home Assistant integration in Fleet API mode.

Were you able to address the issue and successfully switch over to fleet API? What did you do to fix the 401 issue?

[cmilanf]

It happens the same with me when I try to put the tokens that work with Home Assistant integration and via curl. If I log out and try to use the codes it doesnt work.When I change from owner’s api to Tesla Fleet API I get 200 from auth.tesla and 401 from fleet api

That's right, the tokens I get from the explained procedure work well when using the Home Assistant integration in Fleet API mode.

Were you able to address the issue and successfully switch over to fleet API? What did you do to fix the 401 issue?

No, I wasn't. I was just reporting that my tokens work well when calling Fleet API in other scenarios, such as simple cURL calls or Home Assistant unofficial integration.

[jlestel]

Fixed by this PR.

Can you try the fix with this image ? ghcr.io/teslamate-org/teslamate:pr-4095

[JakobLichterfeld]

Can you try the fix with this image ? ghcr.io/teslamate-org/teslamate:pr-4095

To do so, please follow: https://docs.teslamate.org/docs/development#testing-with-our-ci-which-builds-the-docker-images-automatically-per-pr

[yangiak]

Can you try the fix with this image ? ghcr.io/teslamate-org/teslamate:pr-4095

To do so, please follow: https://docs.teslamate.org/docs/development#testing-with-our-ci-which-builds-the-docker-images-automatically-per-pr

with the pr image, I'm still having the 401 error.

teslamate-1  | 2024-07-23 17:59:44.694 [info] Refreshing access token ...
teslamate-1  | 2024-07-23 17:59:44.839 [info] POST https://auth.tesla.com/oauth2/v3/token -> 200 (144.666 ms)
teslamate-1  | 2024-07-23 17:59:44.843 [info] Scheduling token refresh in 6 h
teslamate-1  | 2024-07-23 18:00:14.761 [info] GET https://fleet-api.prd.na.vn.cloud.tesla.com/api/1/vehicles/23453453234235434-> 401 (66.009 ms)

But when I call the endpoint via curl, I can see a successful response.
'https://fleet-api.prd.na.vn.cloud.tesla.com/api/1/vehicles/23453453234235434'

{"response":{"id":23453453234235434,"vehicle_id":23453453234235434,"vin":"23453453234235434","color":null,"access_type":"OWNER","display_name":"MDY","option_codes":null,"granular_access":{"hide_private":false},"tokens":null,"state":"offline","in_service":false,"id_s":"23453453234235434","calendar_enabled":true,"api_version":76,"backseat_token":null,"backseat_token_updated_at":null,"ble_autopair_enrolled":false}}%

[jlestel]

teslamate-teslamate-1  | 2024-07-11 23:04:20.559 [info] GET https://fleet-api.prd.eu.vn.cloud.tesla.com/api/1/products -> 401 (172.994 ms)

@XxTopKillerzZ did you check the necessary boxes when you registered the Tesla application and when you registered your Tesla account on your own Tesla application? ![Uploading manage.png…]()

teslamate-1  | 2024-07-23 18:00:14.761 [info] GET https://fleet-api.prd.na.vn.cloud.tesla.com/api/1/vehicles/23453453234235434-> 401 (66.009 ms)

@yangiak Unlike initial issue, I see it's a call with a vehicle ID. so you managed to list the vehicles previously? (/products)

Does the problem occur after refreshing the tokens only? I cannot reproduce your case by starting a teslamate with valid credentials.

[andrepcg]

Does not work for me. Stuck with [error] POST https://auth.tesla.com/oauth2/v3/token -> 401. Trying to use the Fleet API as well. At this point I need a list of steps in order to configure teslamate with the fleet api

[yangiak]

Hello @jlestel , The product call also had error 401

teslamate-1  | 2024-07-23 17:48:33.660 [info] GET https://fleet-api.prd.na.vn.cloud.tesla.com/api/1/products -> 401 (223.646 ms)
teslamate-1  | 2024-07-23 17:48:33.660 [info] Refreshing access token ...
teslamate-1  | 2024-07-23 17:48:33.660 [warning] Could not get vehicles: :unauthorized
teslamate-1  | 2024-07-23 17:48:33.662 [warning] Using fallback vehicles:

But I can call the endpoint myself.

$ curl --header 'Content-Type: application/json' \
  --header "Authorization: Bearer $TESLA_API_TOKEN" \
  'https://fleet-api.prd.na.vn.cloud.tesla.com/api/1/products'

{"response":[{"id":45756734534676578,"user_id":4576564753435453423,"vehicle_id":3456456745346752345234,"vin":"234213FTR435213","color":null,"access_type":"OWNER","display_name":"MDY","option_codes":null,"cached_data":"dddxvfcsdefewfsdvd"}

[JakobLichterfeld]

At this point I need a list of steps in order to configure teslamate with the fleet api

Which we tried to provide with the docs https://docs.teslamate.org/docs/guides/api ("Requirements: Advanced IT skills")

Every PR to improve the docs is welcome.

For most users Fleet API has only drawbacks atm, therefore it is nor recommended, nor fully supported, nor our focus point.

[andrepcg]

But since the owners api is deprecated and likely to go offline, either Teslamate adapts or stops working. I also have IT skills and have configured the fleet api proxy within homeassistant to work with the forked component and it works. But I haven’t spent enough time with Teslamate to figure out why my access and refresh tokens are not working.

PS: I’m not imposing and if it doesn’t work then that’s the way it is

[TomasCorral]

Fleet API is gargabe for most users now but we have to deal with it. Im already using Fleet API for home assistant because I had too. This means I agreed to an EULA that forbids me from using old APIs. Until I manage to make teslamate work im violating it.

Im also having the same problem, error 401, but everything works using curl and homeassistant. Im following everything from documentation.

[JakobLichterfeld]

Can you try the fix with this image ? ghcr.io/teslamate-org/teslamate:pr-4095

To do so, please follow: https://docs.teslamate.org/docs/development#testing-with-our-ci-which-builds-the-docker-images-automatically-per-pr

This issue will be closed if no feedback on the above test build is received in the next 3 days.

[cmilanf]

I am currently traveling, but I think I can give a try later tonight.

[andrepcg]

Can you try the fix with this image ? ghcr.io/teslamate-org/teslamate:pr-4095

To do so, please follow: docs.teslamate.org/docs/development

This issue will be closed if no feedback on the above test build is received in the next 3 days.

I did try that image and nothing changed. To be honest, I don't even know how the change could possibly fix the issue since System.get_env("TESLA_AUTH_CLIENT_ID") || @web_client_id should be equivalent to System.get_env("TESLA_AUTH_CLIENT_ID", @web_client_id) (not familiar with elixir but i would assume the logic would be equivalent)

[TomasCorral]

It does not work for me.

I assume I’m supposed to change the build, pull new image, log out from teslamate and login with the same tokens I use in homeassistant right?

[jlestel]

This issue will be closed if no feedback on the above test build is received in the next 3 days.

The fix I did worked fine in dev... but I confirm that with the PR image, it's still ownerapi that is still used as client_id :(

Sorry for the back and forth, usually I have the same behavior in dev and when it's release: I'm trying to find the right syntax.

[jlestel]

I fixed the syntax and tried it with the image below. You can try it again @XxTopKillerzZ @cmilanf @yangiak

Be sure to download the use the las version of this image : ghcr.io/teslamate-org/teslamate:pr-4095.

[andrepcg]

I fixed the syntax and tried it with the image below. You can try it again @XxTopKillerzZ @cmilanf @yangiak

Be sure to download the use the las version of this image : ghcr.io/teslamate-org/teslamate:pr-4095.

Now it works, i'm able to sign in using Fleet API tokens. I have another issue now which is related with the https connection as per described in this issue: https://github.com/teslamate-org/teslamate/issues/3979

[JakobLichterfeld]

Now it works, i'm able to sign in using Fleet API tokens.

Perfect, thanks for your feedback! Will be included in next release.

[yangiak]

I fixed the syntax and tried it with the image below. You can try it again @XxTopKillerzZ @cmilanf @yangiak

Be sure to download the use the las version of this image : ghcr.io/teslamate-org/teslamate:pr-4095.

It works for me! Thanks

[JakobLichterfeld]

It works for me! Thanks

Awesome, thanks for the feedback. Fix will be included in upcoming release.

[cmilanf]

I was finally able to test it today, I can confirm the ghcr.io/teslamate-org/teslamate:pr-4095 image is now working fine with the Fleet API.

[JakobLichterfeld]

I was finally able to test it today, I can confirm the ghcr.io/teslamate-org/teslamate:pr-4095 image is now working fine with the Fleet API.

Perfect, thanks for the feedback, and thanks for your patient till next release which will have it included.

[TomasCorral]

It is working for me too, had to log out and log in with access/refresh tokens generated using tesla-http-proxy.

[emilecantin]

For most users Fleet API has only drawbacks atm, therefore it is nor recommended, nor fully supported, nor our focus point.

Can this be called out in the docs? I just went through the rabbit hole of setting all of this up with MyTeslaMate because the docs made it sound like the most future-proof way of doing things, only to have it not reliably detect the car's state... I'll switch back to the older API for now, but the "preferred" and "fully supported" way of doing things should be made obvious.

[JakobLichterfeld]

Can this be called out in the docs? I just went through the rabbit hole of setting all of this up with MyTeslaMate because the docs made it sound like the most future-proof way of doing things, only to have it not reliably detect the car's state... I'll switch back to the older API for now, but the \"preferred\" and \"fully supported\" way of doing things should be made obvious.

It is not mentioned in any official installation guide. In the fleet API guide it is called multiple times, even the drawbacks.

[emilecantin]

None of this left me with the impression that it wasn't recommended or not fully supported. I got the impression that this was where things were going in the future, and the focus of future development.

I don't mind being wrong, but I like to improve things as I go so the next guy isn't wrong in the same way I was.

[JakobLichterfeld]

Thank you. Since you were the first to stumble, you won't be the last. So I am always open to improvements and I understand your point. This was the point that stopped me from merging or implementing the Fleet API in the first place, as there are only drawbacks for 99.9% of users. Using the fleet API is not recommended and has not been recommended in any issue or discussion. The name official indicates something else, I got this point.

[JakobLichterfeld]

You forgot to highlight the sentence however, retrieving vehicle information (vehicle_data) or sending commands is limited.

Anyways, clarification in #4173