Token

Question

Token

RadekSimkanic opened this issue 4 years ago · 33 comments

Hi, I have a problem with creating of Revolut token. I try to run revolut_cli.py and then fill the phone number and application pin. Subsequently, the application gets unknown error:

An unknown error has occurred: Status code 400 for url https://api.revolut.com/signin
{"message":"Please upgrade the app to the latest version to use this functionality","code":2000}

Are this application and library still ready for use?

Answer 1 · 2020-04-08T20:49:06.000Z

Hi, I just managed to generate a new token with the revolut_cli.py.
Could you provide more details please?
That may be a problem for specific countries :/

Answer 2 · 2020-04-09T11:27:29.000Z

I am from czech republic (+420 ... ... ...).
What other information do you need? :-)

Answer 3 · 2020-04-09T15:27:27.000Z

This error (exception) is got by function get_token_step1, respectively when is called c._post

Answer 4 · 2020-04-17T10:20:53.000Z

Hello,

I have the same issue. I tried with the right code and a wrong one (output below).
Is there any way to make more verbose ? Tell me if you need more logs

root@automation-01:/opt/revolut-python# revolut_cli.py
You don't seem to have a Revolut token
Would you like to generate a token [yes/no]? yes
What is your mobile phone (used with your Revolut account) [ex : +33612345678] ? +336XXXXXXXX
What is your Revolut app password [ex: 1234] ? 
An unknown error has occurred: Status code 400 for url https://api.revolut.com/signin
{"message":"Please upgrade the app to the latest version to use this functionality","code":2000}
What is your mobile phone (used with your Revolut account) [ex : +33612345678] ? +336XXXXXXXX
What is your Revolut app password [ex: 1234] ? 
Incorrect login details, please try again.

Rgds

Answer 5 · 2020-04-22T19:20:20.000Z

This error also occurs for me, I'm trying with a Hungarian phone number. Also tried to modify the User-Agent string to "Revolut/6.36.2 603602224 (CLI; Android 6.0)" but that's also not working.

Answer 6 · 2020-04-22T19:31:40.000Z

It is actually not a User-Agent related issue, the X-Client-Version header needs to be updated to the current app version which is 6.36.2.

Answer 7 · 2020-04-22T20:15:06.000Z

Thanks to @ferensz, I released v0.1.3 with a fix for this issue.
Please upgrade with pip3 install revolut==0.1.3.
Could you confirm that it works for you @RadekSimkanic @VictorJ76 ?

Answer 8 · 2020-04-22T20:31:19.000Z

@tducret Please try out the modification on your environment, I'm doing a C# conversion of the code and however the get token step 1 method completes successfully and I got a confirmation code after calling the second step instead of the raw token I'm only getting back this:

{ "thirdFactorAuthAccessToken": "tbmGuF2lr10oSIikWwZKSIxxxxxxxxxxxx" }

I don't know whether it is an issue caused by the conversion or something changed on Revolut's end.

Answer 9 · 2020-04-22T20:59:04.000Z

@tducret Please try out the modification on your environment, I'm doing a C# conversion of the code and however the get token step 1 method completes successfully and I got a confirmation code after calling the second step instead of the raw token I'm only getting back this:

{ "thirdFactorAuthAccessToken": "tbmGuF2lr10oSIikWwZKSIxxxxxxxxxxxx" }

I don't know whether it is an issue caused by the conversion or something changed on Revolut's end.

@tducret You should revert the change, I tested it against python and the error occurs with the incorrect return object.

Answer 10 · 2020-04-22T22:46:03.000Z

I try it, unfortunately, this blocked my account.

Answer 11 · 2020-04-23T06:59:07.000Z

:( Very sorry Radek.
I just deleted the 0.1.3version from Pypi, and reverted the changes as suggested by @ferensz
We need to find a way to solve this.

Answer 12 · 2020-04-23T07:02:07.000Z

To me it seems like the authentication method has been changed by Revolut, based on the fact that the first step is working properly, the verification code SMS/email is sent out as it should.

Answer 13 · 2020-04-24T17:58:32.000Z

@ferensz yup, that's true, phone number and pin code are sent correctly. After then, I receive an email that contains information about blocking my account (due to an attack on my account). None SMS sent.

My account could not be unblocked subsequently by email and SMS, the Revolut application doesn't take the SMS code. I had to communicate this problem via chat (in app). After 24h with communication was my account unlocked.

Answer 14 · 2020-04-24T18:26:21.000Z

@RadekSimkanic They don't even offered me the possibility to unlock my account via email, I had to chat with them through the app. Unless somebody does the reverse engineering of the changed authentication flow I think we're stopped. One alternative I'm working on currently is using the free tier of TrueLayer to access Revolut transactions and payment API through Open Banking standards. I know this is not a direct access to Revolut's system but one which does not blocks the account during development.

Answer 15 · 2020-05-30T09:36:23.000Z

I can report the same issue from Belgium:
{"message":"Please upgrade the app to the latest version to use this functionality","code":2000}
@tducret would you have any update regarding this?

Answer 16 · 2020-05-30T11:08:50.000Z

I'll have a look at it this weekend.

Answer 17 · 2020-05-30T22:08:43.000Z

Well, it appears that when thirdFactorAuthAccessToken is returned in the response (such as for @ferensz), a biometric verification is required.
In this case, Revolut is expecting that the app sends a selfie.
I'm going to update the Python package to raise an error if thirdFactorAuthAccessToken is present (and stop the login procedure to avoid painful account blocking ;) ).
If it is not present (meaning the third factor is not necessary), the original fix #19 should work.

By the way, I found a very cool project which implemented the selfie part (https://github.com/Annihil/revolut-emergency), but I feel it is much more natural for a Desktop app than for a Python package.

Any ideas to support this third factor?

Answer 18 · 2020-05-30T23:36:49.000Z

Alright, I pushed version 0.1.4.dev0 with:

Update X-Client-Version
Raise error when requiring Third factor authentication
Print extra tips to the CLI user when creating the token"; git push --tags

Could you please install it (pip install revolut==0.1.4.dev0) and test it?
I'll release 0.1.4 if it's fine for you.

Answer 19 · 2020-05-31T20:39:52.000Z

During the PR #22 preparation (other subject though), I encountered the infamous thirdFactorAuthAccessToken error (first time for me :/).
Well, since my tests were not over, I retried another token generation.
Something weird happened... the token got generated without requiring a selfie 🤯

Answer 20 · 2020-06-03T08:22:11.000Z

Hello,

Tested with the version revolut==0.1.4.dev1 and got the following error :
An unknown error has occurred: Status code 400 for url https://api.revolut.com/signin
{"message":"Please upgrade the app to the latest version to use this functionality","code":2000}

Answer 21 · 2020-06-03T08:25:03.000Z

Probably a new version has been released from the app so the version number should be bumped. @tducret Based on the apkmirror site the latest version number is 7.1.1

Answer 22 · 2020-06-03T08:54:51.000Z

Facing the third factor authentication (selfie) now. I'll try later and hope that don't ask it again

Answer 23 · 2020-06-15T14:58:39.000Z

Facing the third factor authentication (selfie) now. I'll try later and hope that don't ask it again

I have the same issue 'Token generation with a third factor authentication (selfie) is not cur
rently supported by this package'
'

Answer 24 · 2020-07-02T16:40:00.000Z

It seems Revolut is now even invalidating old tokens. Mine stopped working today.

Answer 25 · 2020-08-12T22:57:58.000Z

With some inspiration from Annihil/revolut-emergency I've implemented the biometric login challenge and created a pull request here.

Answer 26 · 2020-08-13T21:20:11.000Z

Should be solved now.
Consider upgrading to v0.1.4 > pip install revolut==0.1.4

Answer 27 · 2021-06-06T14:48:03.000Z

Installed v 0.1.4, getting the same error 2000.

┌─[laur89@desk]─[~]
└──╼ + revolut_cli.py 
You don't seem to have a Revolut token
Would you like to generate a token [yes/no]? yes
What is your mobile phone (used with your Revolut account) [ex : +33612345678] ? +372562***** (Estonian number)
What is your Revolut app password [ex: 1234] ? 
An unknown error has occurred: Status code 400 for url https://api.revolut.com/signin
{"message":"Please upgrade the app to the latest version to use this functionality","code":2000}

Unsure if related, but when POSTing to https://app.revolut.com/api/retail/signin from web, then the payload also includes a channel attribute:

{"phone":"+372562*****","channel":"APP","password":"1234"}

Perhaps we need to start including the channel from get-go?

Answer 28 · 2022-04-30T15:23:35.000Z

Why is the issue closed? I'm getting the exact same error - phone number from Greece.

Answer 29 · 2022-05-04T10:19:32.000Z

Why is the issue closed? I'm getting the exact same error - phone number from Greece.

Same here. My old token that I generated long time ago still works fine, but I get the same error when I ask for a new token. It must be a change on their side in the meanwhile, since nothing in the script has changed and it used to work flawlessly. Updating the app version in the request headers makes no difference either.

Unfortunately, all in all, the script is now pretty useless until it can generate new tokens again.

Unsure if related, but when POSTing to https://app.revolut.com/api/retail/signin from web, then the payload also includes a channel attribute: {"phone":"+372562*****","channel":"APP","password":"1234"} Perhaps we need to start including the channel from get-go?

Their webapi (app.revolut.com) and app-api (api.revolut.com) seem completely different. They require different headers in any case. And extracting a token from the webapi and plugging in into the app api does not work. Just to be sure I also tried the suggestion above by simply adding a "channel": "APP" header to the requests by the script but that does not work either. Furthermore, the statement above seems to apply to the requesting an authorization code, but that first step actually works fine still (it's just after entering the received authorization code that things go wrong). So long story short this seems to be a wrong route.

One alternative idea would be to create a new script from scratch that mimics the working of their webapp (as it's starting to get pretty feature-complete nowadays), but in terms of usability that would be a pain as it requires authorization on each run time (either in-app, sms, or email) so that means it requires the user's intervention each time while running on the background automatically.

Answer 30 · 2022-05-23T16:10:14.000Z

@allardhs & @KeyC0de take a look at my WIP fork @ https://github.com/laur89/revolut-py/tree/feature/change-to-web-api
It has rewritten most of the token-related code to use Revolut web-api. Also introduces configuration file to provide defaults & persist tokens.

Answer 31 · 2022-07-06T16:04:32.000Z

@allardhs & @KeyC0de take a look at my WIP fork @ https://github.com/laur89/revolut-py/tree/feature/change-to-web-api
It has rewritten most of the token-related code to use Revolut web-api. Also introduces configuration file to provide defaults & persist tokens.

Hey @laur89 awesome, what is the status of your fork were you able to make it work?

Answer 32 · 2022-07-06T16:11:43.000Z

Hey @laur89 awesome, what is the status of your fork were you able to make it work?

Status is it's been working for the past year, but I've not had time (and/or been lazy) to formalize it in order to merge to master. But the feature/change-to-web-api has been working just fine for the past 12 months or so.

Answer 33 · 2022-09-05T14:22:18.000Z

Any updates on this? Not working either with german number