Error 400: invalid_request when authenticating with Google

[WKHarmon]

The problem

I installed the ha-nest-protect integration through HACS and restarted. I'm trying to add the integration now and when I click on the "authorize your account" link I get this error:

Clicking into the error details shows the following:

Error 400: invalid_request
The out-of-band (OOB) flow has been blocked in order to keep users secure. Follow the Out-of-Band (OOB) flow Migration Guide linked in the developer docs below to migrate your app to an alternative method.
Request details: access_type=offline response_type=code redirect_uri=urn:ietf:wg:oauth:2.0:oob client_id= scope=openid https://www.googleapis.com/auth/userinfo.profile https://www.googleapis.com/auth/userinfo.email https://www.googleapis.com/auth/nest-account

I've tried it on two separate browsers to the same result.

Edited to add: I found this page: https://developers.google.com/identity/protocols/oauth2/resources/oob-migration

I was successfully able to get a token by appending a ack_oob_shutdown=2022-10-03 parameter to the query string on the auth url.

What version of this integration (ha-nest-protect) has the issue?

0.3.8

What version of Home Assistant Core has the issue?

2022.10.0

Device / Model

Nest Protect (Battery)

Diagnostics information

No response

Home Assistant log

No response

Additional information

No response

[WKHarmon]

I found this page: https://developers.google.com/identity/protocols/oauth2/resources/oob-migration

I was successfully able to get a token by appending a ack_oob_shutdown=2022-10-03 parameter to the query string on the auth url.

[MarElemans]

Thanks! Worked for me

[kcline]

You're solution worked for me too, just commenting to say thanks and add that you need to append &ack_oob_shutdown=2022-10-03 to the url provided in the setup steps (right click the link from HA and copy url, append the command to the link, then paste it into a browser).

I'm definitely not a programmer, more of a tinker'er, so this took me a bit longer to remember to add the & to properly append it. Mostly commenting in case others in my situation (and knowledge level) come across this issue before it's fixed.

[iMicknl]

I will have to fix this in the component indeed; however it worries me that this will eventually be deprecated.

[norwegianisthekey]

I just tried it myself and got the same error but my solution was to press use another account then just use the same google account and it worked. (it gives out a warning about soon it will be deprecated) but yeah quick fix..

[semple1990]

Just highlighting kcline's comment about adding the & as i missed that briefly and wondered why it wasn't working.

So the authorization url should end in ...apps.googleusercontent.com

You'll want to add &ack_oob_shutdown=2022-10-03 to the end to make:

...apps.googleusercontent.com&ack_oob_shutdown=2022-10-03

[FlyersPh9]

Appending &ack_oob_shutdown=2022-10-03 to the end of the URL copied from in HA wasn't working for me. I instead opened the link incognito and was able to get my access token that way.

[water-escape]

i got the access token, but when entering it in HA it give the error " unexpected error" or " invalid authentication"...not sure what now..

[iMicknl]

@water-escape can you create a new issue for this and include your log files? Unexpected error should be logged to your Home Assistant log. Invalid authentication means that the server rejects the token.

[jpearce73]

Just highlighting kcline's comment about adding the & as i missed that briefly and wondered why it wasn't working.

So the authorization url should end in ...apps.googleusercontent.com

You'll want to add &ack_oob_shutdown=2022-10-03 to the end to make:

...apps.googleusercontent.com&ack_oob_shutdown=2022-10-03

I am getting something slightly different out of the UI link. I already have an extra parameter. My URL looks like this
https://.............apps.googleusercontent.com&flowName=GeneralOAuthFlow
Perhaps because I have a few Google accounts?
The reply gives me this page

Continuing with my chosen ID fails with the message shown at the top of this thread, whether I append '&ack_oob_shutdown=2022-10-03' or not

[redford-jones]

The workaround above appears to have stopped working, at least for me. I consistently get a 400 despite adding the query string shown above.

[tre4b]

I too have this issue, exactly the same as the OP.

One thing I wondered is whether this is down to the fact that the google account I am using is not my default account. That one is a GSuite account and Nest does not work with those so I had to create an individual account. I am logged into that account when I attempt to link the integration but get the message above...

[hallidaydaniel]

Just highlighting kcline's comment about adding the & as i missed that briefly and wondered why it wasn't working.
So the authorization url should end in ...apps.googleusercontent.com
You'll want to add &ack_oob_shutdown=2022-10-03 to the end to make:
...apps.googleusercontent.com&ack_oob_shutdown=2022-10-03

I am getting something slightly different out of the UI link. I already have an extra parameter. My URL looks like this https://.............apps.googleusercontent.com&flowName=GeneralOAuthFlow Perhaps because I have a few Google accounts? The reply gives me this page

Continuing with my chosen ID fails with the message shown at the top of this thread, whether I append '&ack_oob_shutdown=2022-10-03' or not

yes, I get the same behaviours as this now sadly - not managed to find work around

[idroyIT]

Also the same issue. With &ack_oob_shutdown=2022-10-03 still a 400 error.

[benceh90]

The same problem here. OOB is outdated :(

[Tatey53]

Yes, I can confirm that I get the same 400 error, and adding &ack_oob_shutdown=2022-10-03 gets me past it, but after selecting my account if goes back to the same 400 error

[schmittx]

Same issue here as well.

To clarify for everyone; the OOB flow method appears to be fully deprecated now as of 10/3 according to the Google article that @WKHarmon posted, regardless if the additional parameter is added or not.

Hopefully @iMicknl can update this repo to use the "cookies" auth method that homebridge-nest now solely relies on.

[V69dxz]

After I encountered this problem and solved it(?), I read this thread.

Original approach

• made new google account
• Set up nest account in app (ios)
• Ran login.js in Homebridge
• —> error

Solution:

• Logged in on Nest portal, had to give Nest access to my account
• Started a ne sesion of homebridge in incognito browser
• Ran login.js
• —> Solved: Got the access token

(Don’t know if the plugin works now, because I haven’t adopted any Nest devices yet)

Aha, I now see that this method will be de appreciated ; that the cookie method needs to be used.

[simtreti]

@iMicknl Will you update the repo to correct that issue ?

[iMicknl]

@simtreti eventually, yes. However my time currently is very scarce, so I am open to PR's.

I am not a fan of the cookie method, I have to say, since this is not an easy method for many users. I will need to say if there can be a workaround for this issue, but that will take time.

[simtreti]

@iMicknl Take your time it was just to know if I need to check elsewhere to integrate my new nest protect into HA.

[m3tc0n]

I have the same problem. Hopefully this will be resolved soon.

[sadicarnot]

Before I got into Home Assistant, I had gotten the Starling Home Hub and I was able to get the Protects into Home Assistant via the Starling and HomeKit Controller.

[Monacoslo]

So what is now the solution, how to get Access Tooken now?

[iMicknl]

Before I got into Home Assistant, I had gotten the Starling Home Hub and I was able to get the Protects into Home Assistant via the Starling and HomeKit Controller.

Depending on what they use, we could change this integration as well. Unfortunately, the most user-friendly way of generating a token does not seem supported anymore.

Currently my time is very limited, thus I did not have time to look into this issue. Contributions to this integration are always welcome. Otherwise, we would just need to wait. If you are able to generate a token in a different way, you can pass this in the integration as well.

[Monacoslo]

But are there any other options how to get token?

[MaJonker]

What an extremely buggy solution... I have been trying to integrate Nest into Home Assistant for weeks and have no luck whatsoever. The official Google-way is complicated AF and totally does not work, this solution seemed hopeful until this error. Adding stuff to the url did not help. Any thoughts on how to get an authentication?

[iMicknl]

@Monacoslo @MaJonker let's move the asks / discussion to the Home Assistant Community Forum: https://community.home-assistant.io/t/support-for-nest-protect/310084/last.

Unfortunately, Google changed their authentication mechanism, and this was a risk we knew from the beginning. The aim of this integration was to offer the most user-friendly way of authenticating to Nest server and including Nest Protect in our Home Assistant installation, until Google finally adds support to their SDM API (official API).

Let's discuss actual workarounds and investigating of the issue here.

[rollac01]

I don't suppose there has been any fix for this issue? I have just downloaded this integration through HACS for the first time and at this stage I am unable to generate an access token. Thanks.

[iMicknl]

@Naldjer, @rollac01 you have to download the beta version. The current stable version doesn't work for new accounts.

[Naldjer]

@iMicknl many thanks! Got it working now! :)

[Trembler34]

I am finally getting around to checking why all my stuff got disconnected. I noticed in my intergrations it says user logged out. I went through the readme again but can't seem to find the IssueToken anymore. I'm sure I missed something or some process has changed its been awhile since I set this up.. I figured the readme would be updated.. What is the new process to get this working?

[simonotter]

Could anyone tell me how to install the beta version in HACS to use the working authentication method, please?

[dfensom]

https://community.home-assistant.io/t/integrating-nest-protect-smoke-alarms/603253

[CaptainLexington]

I'm not an expert in auth methods, but I think they have changed their API. Trying this just now on Opera, I had nothing in the network tab filtered with issueToken. But filtering just for issue, I get https://nestauthproxyservice-pa.googleapis.com/v1/issue_jwt, which is a POST instead of a GET, and the auth token is in the request payload rather than the URI. Obviously, just copying this URL into the first box does not work. iframe request with the cookie still seems to work, although it doesn't seem to have the rpc substring anymore.

[TheShai1]

Couple things;

1. Was told to download the latest Beta Release. None of the downloadable versions in HACS say Beta. The most recent "Pre-Release" version v0.4.0b7 is the version I had installed and did nothing. I tried rolling back to the previous version and got the same result.
2. In HA there is no network tab in Developer Tools; therefore there is no "Preserve Log" to check and no "Filter" box to enter "issue token".
3. One network call (beginning with iframerpc) does not appear in the Dev Tools window, so we cant click on it.
4. No headers tab under General so there is no issue token.
   Can't complete any of this integration instructions except opening home.nest.com

[iMicknl]

@TheShai1

1. You found the right version, pre-release 0.4.0b7 is the last 'beta' version. What do you mean with 'did nothing'? Good to report your issues in a new issue (not in this issue please).
2. Developer Tools does not refer to the Home Assistant developer tools, but to the developer tools of Chrome or Edge browser.
3. Most likely related to not selecting preserve log.
4. Most likely related to not being in the right developer tools.

I am aware that the instructions could use some love and that the beta / pre-release version isn't ideal at the moment, but unfortunately the pre-release is not ready for an official release yet due to some bugs (where I don't have much time to fix it)>

[TheShai1]

I still keep getting the same error from Google Nest. But now that I know you mean the developer tools in chrome I'll have to try that.
I can report in a new issue. I went to this one as the other one was closed.
I understand still having bugs before releasing official version plus Google can be a PITA but I do appreciate the effort as I've wanted to incorporate my nest protects in.

[TheShai1]

@iMicknl Thank you!!!! I just tried it and it worked!!!! It doesn't show the actual devices with entities underneath but it does show all the entities.
Thank you for the quick response and your efforts.

[iMicknl]

@TheShai1 feel free to comment / do a pull request on what can be improved in our documentation.

[smholsen]

@iMicknl Thanks for an the work on this integration.
I am same to enable the integration using the token steps, but I have to redo it every time HA restarts. Is this expected? (Or should the tokens actually persist through restarts)?

[iMicknl]

Personally I am still on the old authentication method... I understood that the tokens should actually live more than a few weeks usually. Did you start the session in private mode?

[smholsen]

Personally I am still on the old authentication method... I understood that the tokens should actually live more than a few weeks usually. Did you start the session in private mode?

I've actually tried both incognito and without. Not sure if the cause is that the token is "forgotten" in HA on restarts, or something else.
I've thought about creating an automation in HA that checks the status of the integration, and performs the token retrieval and re-setup of the integration when it becomes unavailable. But I don't really want to store my pw in HA secret, and also I guess it would be tricky with 2fa. Perhaps it is possible to create some sort of app-token or something I could use 🤔
Would be curious to hear if you have other ideas that might be better for this?

[iMicknl]

Home Assistant doesn't forget the token, a re-login means that the session is not valid anymore. And automating this process will be hard I am afraid, the previous authentication method was great, but got killed by Google... Still hoping that someday someone will figure out / reverse engineer their current login mechanism.

[RobinTTY]

Thanks for all your work with this integration. Would just recommend to add a note to the README that the beta version is required for it to work and maybe reference this issue.