Unable to obtain access token

[afriedsam]

Running the following code:
from venmo_api import Client
at = Client.get_access_token(username='*****************', password='***********')

getting the following response:
Error: {'error': {'links': None, 'title': 'Error', 'code': 240, 'message': 'OAuth2 Exception: Unable to complete your request. Please try again later.'}}

My friend @Dean-Katz is having the same issue.

[robhannon]

Same here

[ahatzz11]

I tried to get a new auth token and ran into the same thing today with Client.get_access_token. I was able to obtain a valid bearer token from observing network calls from a web session and that worked great, but being able to obtain a new token from the python lib would be great.

[eddiew]

same here, experienced this today. Works on my local machine but not on a cloud server. Is Venmo is finally locking down this api?

[ahatzz11]

Since I ran into this I decided to do some digging to see if I could hack my way through this a bit. I was able to grab a valid api token from the network tab during a payment, but this python API still didn't seem to work due to a 403. It seems like tokens created before whatever change venmo made are still considered valid, but I unfortunately revoked all the tokens on my account recently and it seems like they don't let you generate one of these tokens any more.

With this 'new' token it seems like there is now a change in their payment flow - I see a new call to /api/eligibility before the api/payments call. This API call returns:

{
    "eligible": true,
    "eligibilityToken": "eyJ...",
    "fees": [
        {
            "productUri": "venmo:product:buyer_protection:f4de...",
            "appliedTo": "227...",
            "feePercentage": 0,
            "baseFeeAmount": 0,
            "calculatedFeeAmountInCents": 0,
            "feeToken": "eyJ..."
        }
    ]
}

The api/payments request then uses the eligibilityToken:

{
    "targetUserDetails":
    {
        "userId": "227..."
    },
    "amountInCents": 1,
    "audience": "private",
    "note": "Test Transaction",
    "type": "pay",
    "fundingSourceID": "368...",
    "eligibilityToken": "eyJ..."
}

Based on the current __send_or_request_money() function it doesn't seem like this token is being passed and is now something venmo requires. I've whipped up a quick local script to send in this new token (along with a cookie and Csrf-Token header) and was able to get this to work. I don't have the time to redo this python API to get it working, but figured I'd leave what I've found so far here in case some one else wants to tackle this issue.

[afriedsam]

If you log in while tracking the network requests you can also pull out both the deviceID and auth code from one of the requests and log in like this:

from venmo_api import Client
client = Client.get_access_token(username='*****************', password='***********', device_id="********")

or

from venmo_api import Client
client = Client(access_token="***************************")

To find device_id or access_token:

1. Log in while tracking the network requests and find the get request to https://account.venmo.com/ (it should be the top one)
2. Search for graphqlHeaderConfig in the response. Here you will find both the device_id and access_token which should work

I am trying to modify the code to pull this info from the request but running into some 403 errors--going to keep trying when I have some time. I don't think you need the eligibility token @ahatzz11.

EDITED: I see you did this already. Going to keep trying to get the token from within code.

[mmohades]

Thanks to everyone for flagging this with detailed info! I'm currently tied up, but I hope to look into this next weekend!

[mmohades]

It seems that Venmo may be actively flagging login attempts. If you use a trusted device-id with get_access_token(username=..., password=..., device_id=TRUSTED_DEVICE_ID), it should work. I tested this and it worked for me.

What's interesting is that I removed my iPhone's device ID from the list of trusted devices on Venmo and logged out of the app. Upon attempting to log in via the API, I got the same 403 on the API. Then I tried to log in on my iPhone again, and I got the same error on my iPhone (see attached screenshot).

[jpjpjp]

To find device_id or access_token:

1. Log in while tracking the network requests and find the get request to https://account.venmo.com/ (it should be the top one)
2. Search for graphqlHeaderConfig in the response. Here you will find both the device_id and access_token which should work

FWIW, I found this differently as I didn't see this particular request or any responses that included anything resembling "device_id".

On the network request to login, I found a 'Set-Cookie' in the response headers that it set a cookie called v_id. I used the value of v_id as the device_id described above in the get_access_token() call, which then gave me an access_token

[habersaat]

Since I ran into this I decided to do some digging to see if I could hack my way through this a bit. I was able to grab a valid api token from the network tab during a payment, but this python API still didn't seem to work due to a 403. It seems like tokens created before whatever change venmo made are still considered valid, but I unfortunately revoked all the tokens on my account recently and it seems like they don't let you generate one of these tokens any more.

With this 'new' token it seems like there is now a change in their payment flow - I see a new call to /api/eligibility before the api/payments call. This API call returns:

{
    "eligible": true,
    "eligibilityToken": "eyJ...",
    "fees": [
        {
            "productUri": "venmo:product:buyer_protection:f4de...",
            "appliedTo": "227...",
            "feePercentage": 0,
            "baseFeeAmount": 0,
            "calculatedFeeAmountInCents": 0,
            "feeToken": "eyJ..."
        }
    ]
}

The api/payments request then uses the eligibilityToken:

{
    "targetUserDetails":
    {
        "userId": "227..."
    },
    "amountInCents": 1,
    "audience": "private",
    "note": "Test Transaction",
    "type": "pay",
    "fundingSourceID": "368...",
    "eligibilityToken": "eyJ..."
}

Based on the current __send_or_request_money() function it doesn't seem like this token is being passed and is now something venmo requires. I've whipped up a quick local script to send in this new token (along with a cookie and Csrf-Token header) and was able to get this to work. I don't have the time to redo this python API to get it working, but figured I'd leave what I've found so far here in case some one else wants to tackle this issue.

@ahatzz11 I'm trying to recreate the same workaround but am having trouble retrieving the eligibility token (getting a 403 error each time). I'm only passing in the access_token in my post request header which I suspect is wrong... can I ask how you set the cookie and Csrf-Token header you mentioned?

[raycekar]

Was planning to try and maybe get a pull request in for a fix but found that when trying to log into venmo on any browser I am presented with a "Something went wrong. Try again later or contact customer support". Script must have tried too many times and locked me out. Anyone else have this for them and did you have to contact customer support?

Edit: guess I was able to use an already trusted device. But it attempting to do the eligibility request, strangely enough I get the 404 error

[raycekar]

Sadly spend some hours on this and when trying to request through either of the following, I get a 404 error, invalid json and can't seem to figure out why:
https://account.venmo.com/api/eligibility - trying to get eligibility token
https://account.venmo.com/_next/data/PS8KMzrdGzuzFp7z0vH5i/en/pay.json - attempting to get csrf-token to feed into eligibility request

[raycekar]

Further digging, I see the HTTP version is HTTP/2 from the developer tools network tab. From what I can see, the requests package only support HTTP/1.1 while another package, HTTPX, supports the new standard. Could this be a possible reason for the 403/404 errors?

EDIT: after reading up on it, sounds whatever site would have to block http/1.1, which im now doubting they would do that since other folks got it to work and the tool still logs in.

[mattmijo]

It seems that Venmo may be actively flagging login attempts. If you use a trusted device-id with get_access_token(username=..., password=..., device_id=TRUSTED_DEVICE_ID), it should work. I tested this and it worked for me.

What's interesting is that I removed my iPhone's device ID from the list of trusted devices on Venmo and logged out of the app. Upon attempting to log in via the API, I got the same 403 on the API. Then I tried to log in on my iPhone again, and I got the same error on my iPhone (see attached screenshot).

I followed these steps but still results in a 403 error

import requests
from venmo_api import Client
access_token = Client.get_access_token(username='blah', password='blah', device_id='longer blah')
print("My token:", access_token)
print(response.status_code)
print(response.json)

not sure what is happening here.