feat(auth): add DataDome bypass and PIN-based authentication #378
Conversation
Handle DataDome bot protection by fetching SDK cookies before API requests. Add central _post() method for all API calls with automatic DataDome cookie management and 403 retry logic. Support PIN-based authentication flow (authByRequestPin endpoint) as primary auth method. Always send x-correlation-id header on all requests. Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
for more information, see https://pre-commit.ci
silamon
left a comment
silamon
left a comment
There was a problem hiding this comment.
Nice work, seems to be rock solid. Still a bit unfortunate that there's an input requirement in the middle of the process, which can be considered a breaking change for non cli programs that use this library.
| if pin: | ||
| return self._auth_by_pin(polling_id, pin) | ||
|
|
||
| for _ in range(MAX_POLLING_TRIES): |
There was a problem hiding this comment.
This is dead code, if you don't enter the pin, you need to open the email on the exact same device. That's a new security enhancement of tgtg. Since we're mimicking the user agent and simulating the datadome protection, it's almost impossible to do so.
There was a problem hiding this comment.
I testet it and it's working. by the way tgtg is sending a pin and a link on email. opening link is not going to work but pin is working and bypassing the new sec control by tgtg. do you want to send you video of testing in the terminal?
There was a problem hiding this comment.
I believe you and we're saying the same. I just think we should not keep the code that works on the email if it's clearly no longer working due to tgtg.
3 participants
Summary
api-sdk.datadome.cowith Android device fingerprint before API requests, preventing 403 CAPTCHA blocksauth/v5/authByRequestPinendpoint as primary auth method (TGTG moved from email link verification to PIN codes)_post()method: All API calls route through_post()with automatic DataDome cookie management and 403 retry logicx-correlation-idheader: Sent on all requests to match real APK behaviorDetails
The TooGoodToGo API now uses DataDome for bot detection, which blocks requests without a valid
datadomecookie. This PR adds a_fetch_datadome_cookie()method that mimics the Android SDK's cookie request with proper device fingerprint parameters.Authentication has also changed from email link verification to PIN codes sent via email. The new
_auth_by_pin()method and updatedstart_polling()support this flow, with fallback to the existing polling method.Test plan
TGTG_EMAIL)get_favorites()returns results after login🤖 Generated with Claude Code