Core: August component does not load because of invalid API key

[gary-reyes]

Home Assistant release with the issue: 0.75.2 (although its not tied to release)

Last working Home Assistant release (if known): 0.75.2

Operating environment (Hass.io/Docker/Windows/etc.): Hass.io

Component/platform: august

Description of problem:
August component stopped working and a restart of hass gives an invalid configuration

Problem-relevant configuration.yaml entries and (fill out even if it seems unimportant):

Traceback (if applicable):

ERROR (MainThread) [homeassistant.setup] Error during setup of component august
Traceback (most recent call last):
  File "/usr/local/lib/python3.6/site-packages/homeassistant/setup.py", line 148, in _async_setup_component
    component.setup, hass, processed_config)  # type: ignore
  File "/usr/local/lib/python3.6/concurrent/futures/thread.py", line 56, in run
    result = self.fn(*self.args, **self.kwargs)
  File "/usr/local/lib/python3.6/site-packages/homeassistant/components/august.py", line 151, in setup
    return setup_august(hass, config, api, authenticator)
  File "/usr/local/lib/python3.6/site-packages/homeassistant/components/august.py", line 120, in setup_august
    hass.data[DATA_AUGUST] = AugustData(api, authentication.access_token)
  File "/usr/local/lib/python3.6/site-packages/homeassistant/components/august.py", line 161, in __init__
    self._doorbells = self._api.get_doorbells(self._access_token) or []
  File "/usr/local/lib/python3.6/site-packages/august/api.py", line 119, in get_doorbells
    access_token=access_token).json()
  File "/usr/local/lib/python3.6/site-packages/august/api.py", line 243, in _call_api
    response.raise_for_status()
  File "/usr/local/lib/python3.6/site-packages/requests/models.py", line 939, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://api-production.august.com/users/doorbells/mine

Additional information:
I tried sending the GET command to the URL indicated using

x-august-api-key: 727dba56-fe45–498d-b4aa-293f96aae0e5
Content-Type: application/json
Accept-Version: 0.0.1
User-Agent: August/Luna-3.2.2
x-august-access-token: removed

but always received

{
    "code": "ForbiddenError",
    "message": "API key is not valid"
}

If I instead used the following key which I found online, then I get valid data for my locks.

x-august-api-key:79fd0eb6-381d-4adf-95a0-47721289d1d9
Content-Type: application/json
Accept-Version: 0.0.1
User-Agent: August/Luna-3.2.2
x-august-access-token: removed

It seems the key that is used is no longer valid

[jsnyde30]

I'm getting the same exact error. It happened to me on 74.0 this evening. Home assistant successfully unlocked the door for me at about 5:15PM EST, and then about an hour later when we left, I noticed my automation didn't lock my door. Upon further investigation, I'm getting the same errors as OP. Just wanted to confirm this does not seem to be a one-off.

EDIT: I also upgraded to 75.2 this evening in an attempt to fix it, but that did not work. Also deleted my august.conf file, and since I run into issues with HA accepting my passwords, I changed my August Password and updated my config and still getting the same error.

[MartinHjelmare]

The api key is received from the August api during authentication, so it's probably the api key refresh logic that needs to be fixed, not just replacing a hard coded key with another key.

The api key is generated at least the first time you login, ie the first time the component was setup with your credentials. Removing the auth cache might force a new attempt to generate api key, after restarting home assistant.

The auth cache file is in the config directory and named:
.august.conf

Note that it's hidden.

Make sure you backup your auth cache file before trying this, so you can go back to previous state of needed.

If a new api key needs to be generated when the old one expires, that problem needs to be fixed first in the py-august library.

[gary-reyes]

@MartinHjelmare
What you are referring to is the token, not the API key which is hardcoded. Removing the config file does not work since it only stores the token

[MartinHjelmare]

Sorry, I misread this issue.

[Maaniac]

I'm experiencing the same issue. Since this morning I am no longer able to use the component. I attempted to change the API key as indicated above but was getting a 403 forbidden error on my frontend.

[Maaniac]

@snjoetw has the API access been removed?

[TimothyLeeAdams]

I'm also having this issue. It started yesterday after an HA reboot, while I was making unrelated config changes. I tried deleting my .august.conf file and instead of the configurator popup asking for the verification code, I now get the error: "403 Client Error: Forbidden for url: https://api-production.august.com/session" on my frontend.

I also tried poking around the API using Postman. Sending a POST to https://api-production.august.com/session using the API key that @gary-reyes noted in his OP, and a randomly generated UUID. The response body comes back with this:

{ "installId": "<removed>", "applicationId": "", "userId": "<removed>", "vInstallId": false, "vPassword": true, "vEmail": false, "vPhone": false, "hasInstallId": true, "hasPassword": true, "hasEmail": true, "hasPhone": true, "isLockedOut": false, "captcha": "", "email": [], "phone": [], "expiresAt": "2018-12-06T19:43:11.574Z", "LastName": "", "FirstName": "" }

and also returns a x-august-access-token response header.

Using the x-august-access-token, I sent a GET to https://api-production.august.com/session and response body was:

{ "code": "MethodNotAllowedError", "message": "GET is not allowed" }

I'm able to help run any other tests, if needed to assist with troubleshooting.

[MichaelKetchel]

I'm also getting the 403 Client Error. I also get it when using py-august directly. The response code and content received by the _call_api method is:
403 b'{"code":"ForbiddenError","message":"API key is not valid"}'

[snjoetw]

Just updated the API key: https://github.com/snjoetw/py-august/commit/688ed4e3727447109868d4ed848f3bedc99a00db

I've tested and it seems to work locally, at least I'm able to authenticate myself now. But I can't really tell if all the APIs are still working as I don't own any August product any more.

I'll make a release and hopefully someone can help testing this component

[Maaniac]

@snjoetw I changed the API key in the .august.conf file but its still not working for me. How would I go about adding your changes as a custom component in home assistant?

[accelle17]

using HASS 0.74.0 on python venv and changed the HEADER_VALUE_API_KEY, it now works.

api.py is on /srv/homeassistant/lib/python3.6/site-packages/august/api.py

[Maaniac]

@accelle17 do you know if this can be done within hass.io?

[rfpludwick]

I am experiencing this same problem.

[snjoetw]

I ran into problem when I was publishing the new version yesterday. I’ll give it another try tonight.

[snjoetw]

@manniac if you’re able to change API key manually as @accelle17 suggested you’ll also need to nuke .august and re-authenticate again

[jsnyde30]

I'm also trying to figure out how to make the adjustments with Hassio.. I've never had to use a command interface with it and the stuff I've been looking up has commands being run to fix. Thanks for helping us out, snjoetw! I'm sure I'll figure out how to apply your fix after playing with it enough.. hoping it works for ya tonight!

[Maaniac]

I have access to the command line within hass.io but cannot locate where api.py would be located.

[TimothyLeeAdams]

@jsnyde30 @Maaniac I'm not running hass.io, but in my home assistant docker, the August lock's "api.py" file is located at:
/usr/local/lib/python3.6/site-packages/august/api.py
Try running a find command from your root directory to locate it:
find . -name "api.py"

[MichaelKetchel]

Changing the API key seems to have worked A-OK for me. Nice when things are simple!

[Maaniac]

@rfpludwick when I run the docker exec -ti homeassistant /bin/bash command it is asking me for a password. Any idea what that would be?

[rfpludwick]

@Maaniac No idea. I wasn't prompted for one. Also, I removed my comment because restarting the HA Docker container resets that API key anyway, so that's not a good fix for hass.io.

[Maaniac]

@TimothyLeeAdams no such directory in Hass.io

[ajdezigns]

@gary-reyes How do we apply this fix to HASS.IO ?

[TimothyLeeAdams]

@Maaniac I just grabbed a spare Pi and spun Hass.io up on it for testing. Unfortunately, I am not able to find the august component py files either, so far. I'll keep testing and see if I can figure it out.

[TimothyLeeAdams]

@rfpludwick I would have expected the file to revert too, as you suggested, but I was able to change the HEADER_VALUE_API_KEY to the new API key that @snjoetw provided, and even after a docker restart, the new key persisted. Still, I believe the API is only used when authenticating anyway, to create the .august.conf file and once that is done, the August component only needs the access token. And since .august.conf is located in the home-assistant config folder, that file is protected.

[gary-reyes]

@TimothyLeeAdams
The API key is sent with each rest command. The access token is sent with each command that requires returning information about the account.

See
https://medium.com/@nolanbrown/august-lock-rest-apis-the-basics-7ec7f31e7874

[TimothyLeeAdams]

Ahhh yes, you're correct. My mistake, thanks for the clarification @gary-reyes

[snjoetw]

I've submitted a PR for this https://github.com/home-assistant/home-assistant/pull/15916. Hopefully this can be released sooner than 0.76

[ajdezigns]

Just updated to HASS.IO 0.78.1 and the issue is back