# Two Factor Auth error using REST API

**URL:** <https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921>\
**Category:** Pipeline Integrations\
**Tags:** bug-fixed, rest-api\
**Created:** [March 27, 2020, 10:19pm UTC](https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921 "2020-03-27T22:19:03Z")\
**Posts on this page:** 12\
**Page:** 1

<div class="post-metadata">

**Author:** ![JokerMartini](https://sea1.discourse-cdn.com/shotgunsoftware/user_avatar/community.shotgridsoftware.com/jokermartini/32/2084_2.png) [@JokerMartini](https://community.shotgridsoftware.com/u/JokerMartini)\
**Post date:** [March 27, 2020, 10:19pm UTC](https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921/1 "2020-03-27T22:19:03Z")

</div>

I’m trying to login using the rest api and we have setup Two-Factor Authentication. How do i achieve this with the rest api. Currently i supply my username and password and when i execute it, i get the following error:

1. responseText: “{“errors”:[{“id”:“61c00f3eff21913f78ce0c537e6b813c”,“status”:400,“code”:106,“title”:“Missing argument for 2FA login”,“source”:{“auth\_token”:“missing for 2FA login”},“detail”:null,“meta”:null}]}”

Code:

```
function queryShotgun() {
    var headers = {
        'Content-Type': 'application/x-www-form-urlencoded',
        'Accept': 'application/json'
    };

    $.ajax({
        url: '####/api/v1/auth/access_token',
        method: 'POST',

        headers: headers,
        data: {
            grant_type: 'password',
            username: '####',
            password: '####'
        },
        success: function (data) {
            console.log(JSON.stringify(data));
            console.log(data);
            $('#accessOutput').html(data.access_token);
        },
        error: function (data) {
            console.log(data);
            $('#accessOutput').html(data.access_token);
        }
    })
}

window.onload = function(){
  queryShotgun();
};
```

---

<div class="post-metadata">

**Author:** ![JokerMartini](https://sea1.discourse-cdn.com/shotgunsoftware/user_avatar/community.shotgridsoftware.com/jokermartini/32/2084_2.png) [@JokerMartini](https://community.shotgridsoftware.com/u/JokerMartini)\
**Post date:** [March 28, 2020, 5:12pm UTC](https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921/2 "2020-03-28T17:12:20Z")

</div>

The reason i ask is because im working on a web application for the studio and we require everyone does two factor authentication, however in my web application im having users login with their shotgun credentials, and realizes the two factor login needs to also be implemented. So any help hear would be awesome. i assume it’s possible considering the python API is doing this some how.

---

<div class="post-metadata">

**Author:** ![JokerMartini](https://sea1.discourse-cdn.com/shotgunsoftware/user_avatar/community.shotgridsoftware.com/jokermartini/32/2084_2.png) [@JokerMartini](https://community.shotgridsoftware.com/u/JokerMartini)\
**Post date:** [March 29, 2020, 7:06pm UTC](https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921/3 "2020-03-29T19:06:32Z")

</div>

I’m completely lost here on why this keeps saying the auth\_token is not supplied when it’s clearly in the payload of the data being passed? I even went as far as to debug print how the python module is doing it. My params are the same and it doesn’t work. Any help is much appreciated. I’ve been at this for several days now with no headway. Not sure why 🤪

{“errors”:[{“id”:“5bb378eacd42696f3b7a6a72aea0e860”,“status”:400,“code”:106,“title”:“Missing argument for 2FA login”,“source”:{“auth\_token”:“missing for 2FA login”},“detail”:null,“meta”:null}]}

```
function checkUserLogin2FA() {    
    $.ajax({
        url: '#####/api/v1/auth/access_token',
        method: 'POST',

        headers: {
            'Content-Type': 'application/x-www-form-urlencoded',
            'Accept': 'application/json',
            'Connection': 'keep-alive'
        },
	    data: {
            grant_type: 'password',
            auth_token: '#####',
            username: '#####',
            password: '#####'
        },
        success: function (data) {
            console.log(JSON.stringify(data));
            console.log(data);
            $('#accessOutput2').html(data.access_token);
        },
        error: function (data) {
            console.log(data);
            $('#accessOutput2').html(data.responseText);
        }
    })
}

window.onload = function(){
  checkUserLogin2FA();
};
```

---

<div class="post-metadata">

**Author:** ![JokerMartini](https://sea1.discourse-cdn.com/shotgunsoftware/user_avatar/community.shotgridsoftware.com/jokermartini/32/2084_2.png) [@JokerMartini](https://community.shotgridsoftware.com/u/JokerMartini)\
**Post date:** [March 30, 2020, 1:37am UTC](https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921/4 "2020-03-30T01:37:21Z")

</div>

I’ve also attempted to do this with python just for the pure sake of making sure i wasn’t going insane and i get the same error and i have no idea why.

```
import json
import requests
import urllib

# Site URL
login_url = 'https://####.shotgunstudio.com/api/v1/auth/access_token'

# URL Encode for safety
url_credentials = urllib.urlencode({
    'username': '####',
    'password': '####',
    'grant_type': 'password',
    'auth_token': '####'
})
headers = {
    'Content-Type': 'application/x-www-form-urlencoded',
    'Accept': 'application/json',
    'Connection': 'keep-alive'
}

# Login using your script credentials
response = requests.post(login_url, data=url_credentials, headers=headers)
print vars(response)
if response.status_code == 200:
    # Get token type and access token from successful response
    _token_type = response.json()['token_type']
    _token = response.json()['access_token']
    token_string = '{0} {1}'.format(_token_type, _token)
    print token_string
```

---

<div class="post-metadata">

**Author:** ![Sreenathan\_Nair](https://sea1.discourse-cdn.com/shotgunsoftware/user_avatar/community.shotgridsoftware.com/sreenathan_nair/32/2144_2.png) [@Sreenathan\_Nair](https://community.shotgridsoftware.com/u/Sreenathan_Nair)\
**Post date:** [March 30, 2020, 3:01am UTC](https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921/5 "2020-03-30T03:01:39Z")

</div>

Hi @JokerMartini,

First off I just want to say that I am not too acquainted with the SG 2FA flow. However, I do not believe it is possible to side-step the Two-factor Authentication. In general terms, the 2FA exists to **prevent** things such as script logins and is intended to be used by a human user at the time of login.

Also, `auth_token` is not a valid key for `grant type: password`. [according to the docs](https://developer.shotgunsoftware.com/rest-api/#password-credentials)

If I understand your situation correctly, you are trying implement authentication in your own custom site that hooks into the SG API for validating the username/password?

If this is the case then it would be fair to assume that you need the user’s login for contextual filtering etc. Depending on the size of your user base, you may just want to maintain a separate auth database (Perhaps you already have AD/LDAP etc) for authentication. Then once successfully authenticated, in your site you can setup a script user with `client_credentials` for querying relevant data from SG using the previously gained `username`. This should work out for you as long as the logins between your auth database and SG match.

I would recommend **against** disabling 2FA or sending a username/password combo to SG. The `client_credentials` grant\_type and with `Pipeline Scripts` would I believe be the best way to move forward for you, though I will leave it up to an SG Admin to comment on best practices.

---

<div class="post-metadata">

**Author:** ![JokerMartini](https://sea1.discourse-cdn.com/shotgunsoftware/user_avatar/community.shotgridsoftware.com/jokermartini/32/2084_2.png) [@JokerMartini](https://community.shotgridsoftware.com/u/JokerMartini)\
**Post date:** [March 30, 2020, 11:42am UTC](https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921/6 "2020-03-30T11:42:26Z")

</div>

I would imagine the rest api supports it somehow as this is done in their python tools. And after digging around in their python files I saw they were doing it almost identical to mine. I’m creating a web tool where I need a user to be able to login in order to use it.

The shotgun toolkit has users login via python and do it very similar with the TFA within the tool. Maybe there is a way. Otherwise that would be so sad.

---

<div class="post-metadata">

**Author:** ![JokerMartini](https://sea1.discourse-cdn.com/shotgunsoftware/user_avatar/community.shotgridsoftware.com/jokermartini/32/2084_2.png) [@JokerMartini](https://community.shotgridsoftware.com/u/JokerMartini)\
**Post date:** [March 30, 2020, 12:02pm UTC](https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921/7 "2020-03-30T12:02:00Z")

</div>

These are the agruments the python implementation is using…

\_http\_request verb: POST  
\_http\_request path: /api3/json  
\_http\_request body: {“method\_name”: “get\_session\_token”, “params”: [{“user\_login”: “####”, “user\_password”: “####”, “auth\_token”: “####”}]}  
\_http\_request headers: {‘connection’: ‘keep-alive’, ‘content-type’: ‘application/json; charset=utf-8’, ‘user-agent’: ‘shotgun-json (3.2.2); Python 2.7 (Windows); ssl OpenSSL 1.0.2k 26 Jan 2017 (validate)’}  
\_http\_request url: https://###.shotgunstudio.com/api3/json  
\_http\_request scheme: https  
\_http\_request server: ###.shotgunstudio.com  
\_http\_request path: /api3/json

---

<div class="post-metadata">

**Author:** ![JokerMartini](https://sea1.discourse-cdn.com/shotgunsoftware/user_avatar/community.shotgridsoftware.com/jokermartini/32/2084_2.png) [@JokerMartini](https://community.shotgridsoftware.com/u/JokerMartini)\
**Post date:** [April 1, 2020, 12:40pm UTC](https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921/9 "2020-04-01T12:40:33Z")

</div>

Did anyone have any suggestions on how to do this in javascript? We are trying to get users setup from home with user logins, however we need the TFA to work from.

---

<div class="post-metadata">

**Author:** ![bouchep](https://sea1.discourse-cdn.com/shotgunsoftware/user_avatar/community.shotgridsoftware.com/bouchep/32/93_2.png) [@bouchep](https://community.shotgridsoftware.com/u/bouchep)\
**Post date:** [April 3, 2020, 5:59pm UTC](https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921/14 "2020-04-03T17:59:11Z")

</div>

Hi @JokerMartini,

This seemed pretty simple to me but I couldn’t figure what you were doing wrong. I tried writing my own version of this in Python and went down the rabbit hole of debugging it. Turns out, we’ve got a bug (which I’ve now ticketed up for the engineering team) where the `auth_token` isn’t being forwarded properly and causing this issue.

Long story short, I’m sorry to say this is a bug on our side.

I’m not sure if you have an alternate authentication source as @Sreenathan_Nair was suggesting. As he said, you could authenticate against that alternate source and assuming there’s a mapping between the alternate source and Shotgun’s logins you could use a script name/key and `sudo` functionality in your web app’s backend.

---

<div class="post-metadata">

**Author:** ![JokerMartini](https://sea1.discourse-cdn.com/shotgunsoftware/user_avatar/community.shotgridsoftware.com/jokermartini/32/2084_2.png) [@JokerMartini](https://community.shotgridsoftware.com/u/JokerMartini)\
**Post date:** [April 3, 2020, 6:45pm UTC](https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921/16 "2020-04-03T18:45:17Z")

</div>

Hey Bouchep,  
Thanks for looking at this. Does this mean the dev team will add the auth\_token support into the rest api since it currently is not a supported parameter when trying to use login credentials?

Secondly, is there a public ticketing board or way of me following the ticket to know when its addressed so I could implement this?

The way we have things structure on this custom site it would be more work developing something new, vs waiting for this to be fixed so users can simply login using their shotgun usernames.

I’m glad we found the bug though and hope we can resolve it. 🙂

---

<div class="post-metadata">

**Author:** ![bouchep](https://sea1.discourse-cdn.com/shotgunsoftware/user_avatar/community.shotgridsoftware.com/bouchep/32/93_2.png) [@bouchep](https://community.shotgridsoftware.com/u/bouchep)\
**Post date:** [April 3, 2020, 6:50pm UTC](https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921/18 "2020-04-03T18:50:34Z")

</div>

Our bug tracker isn’t publicly available, but you can track the [release notes](https://community.shotgridsoftware.com/t/8-10-release-notes/7208) for the current version and the [release notes category](https://community.shotgridsoftware.com/c/shotgun/release-notes).

When we address the issue, it’ll show up there as `SG-16940`.

I can’t give you an ETA but the issue has been prioritized _really close_ to the top of the pile. 😉

---

<div class="post-metadata">

**Author:** ![patrick-hubert-adsk](https://sea1.discourse-cdn.com/shotgunsoftware/user_avatar/community.shotgridsoftware.com/patrick-hubert-adsk/32/257_2.png) [@patrick-hubert-adsk](https://community.shotgridsoftware.com/u/patrick-hubert-adsk)\
**Post date:** [April 17, 2020, 2:44am UTC](https://community.shotgridsoftware.com/t/two-factor-auth-error-using-rest-api/7921/19 "2020-04-17T02:44:15Z")

</div>

Good evening,

The latest version of Shotgun, released today, contains support for the `auth_token`.

The online doc, at [https://developer.shotgunsoftware.com/rest-api/#password-credentials](https://developer.shotgunsoftware.com/rest-api/#password-credentials), have been updated to reflect that fact.

Happy coding,

-Patrick