Repository navigation
fix(auth): use the new My Porsche app callback URL - #100
Merged
Merged
Conversation
Porsche removed my-porsche-app://auth0/callback from the allowed callbacks of the app client, so /authorize returns 403 "Callback URL mismatch" and every login fails before the identifier step. The current app (de.porsche.one 21.26.46) uses the same client_id with the https://security.porsche.com/auth/en-GB/app/callback app link. Also bump the user agent to match the current app build. Refs CJNE/ha-porscheconnect#465, CJNE/ha-porscheconnect#466
Collaborator
|
Great work! Thanks. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Since about 2026-11-05 every login fails. The stored refresh token is rejected, and the fallback full login stops at
get_and_extract_location_params()withPorscheExceptionError("Could not fetch authorization code").GET /authorizereturns 403unauthorized_client: Callback URL mismatch, because Porsche removedmy-porsche-app://auth0/callbackfrom the app client's allowed callbacks.Reported in CJNE/ha-porscheconnect#465 and CJNE/ha-porscheconnect#466.
Fix
The
client_id(XhygisuebbrqQ80byOuU5VncxLIm8E6H) is unchanged. The current My Porsche Android app (de.porsche.one21.26.46-row+195601) passes an HTTPS app link toWebAuthProvider...withRedirectUri(...):This PR switches
REDIRECT_URIto that URL and bumpsUSER_AGENTto the current app build. No other code changes.The app's custom-scheme fallback (feature toggle
access_login_redirect_uri_use_custom_scheme,my-porsche-app-auth0://auth0/callback) is not whitelisted either, so I didn't use it. Only theen-GBpath is registered;de-DEetc. return 403.Testing
/authorizewith PKCE through this branch'sOAuth2Client.get_and_extract_location_params()returns 302 to/u/login/identifier. Before the change it returned 403./oauth/token,GET /connect/v1/vehicles, vehicle measurements, andrefresh_token(which also rotates the refresh token). It has been running in Home Assistant (ha-porscheconnect 0.1.12, HA 2026.11.1) since then.ruff check/ruff format --checkare clean.Existing installs need one fresh login after the upgrade (the old refresh token is dead), e.g. Reconfigure in ha-porscheconnect.