feat(NZ): add browser-based OAuth auth for New Zealand - #1076
Draft
thesquib wants to merge 3 commits into
Draft
Conversation
The NZ Kia Connect signin endpoint (/api/v1/user/signin) uses TLS fingerprinting to reject non-browser HTTP clients. Python's requests library cannot authenticate NZ users via the standard password flow. Changes: - KiaUvoApiAU.login(): raises AuthenticationError immediately for NZ with a message directing callers to use the browser-based flow - KiaUvoApiAU.get_authorize_url(): returns the OAuth authorize URL for the user to open in a browser - KiaUvoApiAU.login_with_auth_code(): exchanges a browser-obtained auth code for tokens, bypassing the fingerprinted signin endpoint; stores the raw OAuth refresh token so renewal works without re-authentication - KiaUvoApiAU.refresh_access_token(): overridden for NZ to use grant_type=refresh_token with the stored token rather than calling login() again - ApiImpl: adds get_authorize_url() and login_with_auth_code() stubs raising NotImplementedError for regions that don't use browser auth - VehicleManager: adds get_authorize_url() and login_with_auth_code() pass-throughs - _get_authorization_code_with_redirect_url(): adds mobileNum field to match what the NZ web app sends Tested and confirmed working on a real NZ Kia Connect account.
for more information, see https://pre-commit.ci
cdnninja
reviewed
Apr 20, 2026
| f"{self.__class__.__name__} does not support browser-based authentication" | ||
| ) | ||
|
|
||
| def login_with_auth_code( |
Collaborator
There was a problem hiding this comment.
I am wondering if you found a better way to do the exact same thing EU has currently. Right now a script is used to get through a captcha on that one and grab the token and pass it in.
Collaborator
|
Any chance the flow over in https://github.com/TMA84/bluelink-refresh-token also works for new zealand? |
Collaborator
|
A new eu flow was just put in place. Could you check if the similar endpoints work for this? |
Author
|
Thanks I'll take a look as soon as I can (at both your comments above) |
cdnninja
marked this pull request as draft
May 24, 2026 21:20
Collaborator
|
@thesquib Any thoughts on this? Should I close the PR? |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The NZ Kia Connect signin endpoint (/api/v1/user/signin) uses TLS fingerprinting to reject non-browser HTTP clients. Python's requests library cannot authenticate NZ users via the standard password flow.
Changes:
Tested and confirmed working on a real NZ Kia Connect account.