Add OAuth authentication support by paulborile · Pull Request #331 · vitiko98/qobuz-dl

paulborile · 2026-04-05T18:16:31Z

Summary

Add OAuth authentication support since Qobuz deprecated basic auth
Extract private_key from Qobuz bundle for OAuth flow
Add login_with_oauth_code() method to Client
Add oauth subcommand with local server to capture auth code automatically
Store private_key in config file

Changes

qobuz_dl/bundle.py: Add get_private_key() method
qobuz_dl/qopy.py: Add login_with_oauth_code() method
qobuz_dl/cli.py: Handle OAuth command and store private_key in config
qobuz_dl/commands.py: Add oauth subcommand
qobuz_dl/core.py: Add handle_oauth_login() and initialize_client_with_oauth()

Usage

qobuz-dl oauth
# Opens browser for login, captures code automatically

Fixes #330 , could fix #329 #316

- Tested POST vs GET for /user/login - both fail with 401 - Tested signature-based auth - still fails - qobuz-api-rust also can't login with email/password - Token-based auth may be the only working method now

- Tested GET/POST, device_manufacturer_id, password formats - all fail - Discovered new signature mechanism in web player bundle.js - Email/password login appears to be completely broken - Need to reverse-engineer new auth or use token-based login

- Add auth_with_token() method to qopy.Client - Add initialize_client_with_token() to QobuzDL core - Update CLI to read user_id and user_auth_token from config - Update _reset_config to support token-based setup - Add instructions in QOBUZ_AUTH_ISSUE_REPORT.md

Token auth works for login but download signatures need updating. Changes: - Add skip_auth parameter to qopy.Client.__init__ - Add auth_with_token() method for user_id + user_auth_token login - Update initialize_client_with_token() in core.py - CLI now reads user_id and user_auth_token from config Status: - Login: WORKS (verified with Paul's account) - Downloads: FAILS (signature algorithm changed by Qobuz) See QOBUZ_AUTH_ISSUE_REPORT.md for full details.

- Extract private_key from Qobuz bundle for OAuth flow - Add login_with_oauth_code() method to Client - Add oauth subcommand with local server to capture auth code - Automatically parse code from redirect URL - Store private_key in config file

The OAuth flow from PR vitiko98#331 works but doesn't persist the token. Subsequent dl/fun/lucky commands still read old email/password and fail. Changes: - initialize_client_with_oauth() now returns usr_info - handle_oauth_login() returns user_id + user_auth_token - cli.py oauth block saves token to config.ini and clears email/password

flaviovivorio · 2026-04-07T23:10:01Z

after cloning your repo I wasn't able to run qobuz-dl script, getting the following error:

bash: ./qobuz-dl: impossible: required file not found

steps to reproduce:

git clone https://github.com/paulborile/qobuz-dl.git

cd qobuz; python3 -m venv qobuz-dl

source qobuz-dl/bin/activate

pip3 install qobuz-dl

was not able to run ./qobuz-dl oauth at all

did I miss anything?

flaviovivorio · 2026-04-07T23:17:14Z

UPDATE

after running ./python3.12 qobuz-dl oauth from inside the "/venv/qobuz-dl/bin" folder I got this new error:

usage: qobuz-dl [-h] [-r] [-p] {fun,dl,lucky} ... qobuz-dl: error: argument command: invalid choice: 'oauth' (choose from 'fun', 'dl', 'lucky')

running with Python 3.12.3 from Ubuntu 24.04 LTS (GNU/Linux 6.17.0-20-generic)

paulborile · 2026-04-08T08:54:01Z

UPDATE

after running ./python3.12 qobuz-dl oauth from inside the "/venv/qobuz-dl/bin" folder I got this new error:

usage: qobuz-dl [-h] [-r] [-p] {fun,dl,lucky} ... qobuz-dl: error: argument command: invalid choice: 'oauth' (choose from 'fun', 'dl', 'lucky')

running with Python 3.12.3 from Ubuntu 24.04 LTS (GNU/Linux 6.17.0-20-generic)

I use :
pip install -e .
and then just run the command
qobuz-dl oauth (not ./)

flaviovivorio · 2026-04-08T15:12:29Z

I was cloning the wrong branch (master instead of bug/newauth). Thank you for the help!

Orald-0 · 2026-04-09T11:39:20Z

@paulborile I use this program on a headless pc. Is there any way to login without a gui browser? Maybe logging in from another pc and in some way using that login on the headless one?

EDIT: while trying to login from a normal pc I noticed that the browser is not actually opening

paulborile · 2026-04-09T12:26:22Z

@paulborile I use this program on a headless pc. Is there any way to login without a gui browser? Maybe logging in from another pc and in some way using that login on the headless one?

EDIT: while trying to login from a normal pc I noticed that the browser is not actually opening

Open this URL in your browser to authenticate with Qobuz: https://www.qobuz.com/signin/oauth?ext_app_id=798273057&redirect_url=http://localhost:43051 A local server on port 43051 will capture the OAuth code automatically. Press Enter after completing login in your browser...

This is the sequence to login so yes, you need to open a browser on that url. Once done you can copy ~/.config/qobuz-dl/config.ini on the headless machine and it should work untill the token expires

SameOldAgony · 2026-04-10T03:36:33Z

Can't figure out how to make this work. Downloaded and unzipped the files from the bug/newauth repository, but even after I put in qobuz-dl oauth or qobuz-dl -sc I still get the unrecognized script response whenever I try in the command prompt. I'm not good at dealing with code at all, so help here would be appreciated.

anatosun · 2026-04-10T11:19:55Z

... and if you rely on this tool on a remote server: ssh -L 36235:localhost:36235 user@remote-host

anatosun · 2026-04-10T11:20:15Z

@SameOldAgony make sure you're running the right binary with which qobuz-dl

CiaoBye · 2026-04-10T13:40:25Z

1.pip3 uninstall qobuz-dl --break-system-packages -y
2.pip3 install git+https://github.com/vitiko98/qobuz-dl.git@refs/pull/331/head --break-system-packages
3.qobuz-dl -r
4.qobuz-dl oauth
5.enjoy

SameOldAgony · 2026-04-10T21:15:55Z

1.pip3 uninstall qobuz-dl --break-system-packages -y 2.pip3 install git+https://github.com/vitiko98/qobuz-dl.git@refs/pull/331/head --break-system-packages 3.qobuz-dl -r 4.qobuz-dl oauth 5.enjoy

It all worked, thanks a lot

arena-andr · 2026-04-11T13:26:47Z

An alternate way to install if you have the repo cloned, same result as CiaoBye's comment above #331 (comment)

git clone https://github.com/vitiko98/qobuz-dl.git
git pull origin pull/331/head
pip install .
qobuz-dl -r
qobuz-dl oauth

- Extract private_key from Qobuz bundle for OAuth flow - Add login_with_oauth_code() method to Client - Add oauth subcommand with local server to capture auth code - Add token-based authentication support (user_id + user_auth_token) - Store private_key and OAuth tokens in config file Co-Authored-By: paulborile <paulborile@users.noreply.github.com>

tenets-gamma · 2026-04-13T19:18:31Z

This was working for about an hour until I got this error


Traceback (most recent call last):
File "/opt/homebrew/bin/qobuz-dl", line 6, in
sys.exit(main())
~~~~^^
File "/opt/homebrew/lib/python3.14/site-packages/qobuz_dl/cli.py", line 208, in main
qobuz.handle_oauth_login(arguments.code)
~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^
File "/opt/homebrew/lib/python3.14/site-packages/qobuz_dl/core.py", line 306, in handle_oauth_login
self.initialize_client_with_oauth(code, self.app_id, self.secrets, self.private_key)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/opt/homebrew/lib/python3.14/site-packages/qobuz_dl/core.py", line 90, in initialize_client_with_oauth
usr_info = self.client.login_with_oauth_code(code, private_key)
File "/opt/homebrew/lib/python3.14/site-packages/qobuz_dl/qopy.py", line 236, in login_with_oauth_code
r.raise_for_status()
~~~~~~~~~~~~~~~~~~^^
File "/opt/homebrew/lib/python3.14/site-packages/requests/models.py", line 1028, in raise_for_status
raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://www.qobuz.com/api.json/0.2/oauth/callback?code=REDACTED&private_key=REDACTED&app_id=REDACTED

jds-official · 2026-04-17T19:09:41Z

#331 (comment) totally worked for me. I'll edit this comment if anything about that changes. Thank you so much!

jds-official

This branch works, the main trunk does not. LGTM!

varris1 · 2026-04-19T12:05:52Z

The local webserver doesn't work for me (It's not reachable). But adding the user id and token by hand works. Thanks for the PR.

Live test on a Studio account (2026-04-26) downloaded a full album in FLAC 16/44.1, with cfg_setup() finding a valid MD5-signing app secret on the first probe. PR vitiko98#331's 'Track Downloads BROKEN' claim appears to have been account- or region-specific rather than a global Qobuz signing migration. The CLI's defensive layers (cfg_setup downgrade-to-warning, pre-flight client.sec is None guard, belt-and-braces try/except InvalidAppSecretError around _handle_commands) are all still appropriate — they just don't fire for accounts on the legacy signing path. They'll handle accounts that DO see the new SHA-256 path gracefully (clean exit 3 + README pointer instead of a traceback). Update README status banner to: - frame login as the headline change (it's the actual blocker) - note downloads have been verified end-to-end - describe InvalidAppSecretError as a partial-rollout case the CLI handles, not a known failure mode The 'Downloads currently fail' alarmism was based on PR vitiko98#331's investigation report; live testing didn't reproduce it.

NexusPenguin · 2026-06-06T08:51:08Z

1.pip3 uninstall qobuz-dl --break-system-packages -y 2.pip3 install git+https://github.com/vitiko98/qobuz-dl.git@refs/pull/331/head --break-system-packages 3.qobuz-dl -r 4.qobuz-dl oauth 5.enjoy

Worked like a charm !
Thanks...

paulborile added 8 commits April 5, 2026 10:42

docs: update auth issue with investigation results

3fcd895

- Tested POST vs GET for /user/login - both fail with 401 - Tested signature-based auth - still fails - qobuz-api-rust also can't login with email/password - Token-based auth may be the only working method now

docs: update auth report with complete technical summary

b38e758

Add OAuth authentication support

cc5ed0c

- Extract private_key from Qobuz bundle for OAuth flow - Add login_with_oauth_code() method to Client - Add oauth subcommand with local server to capture auth code - Automatically parse code from redirect URL - Store private_key in config file

saving token

56a4caf

add venv to gitignore

bafc61e

jds-official approved these changes Apr 17, 2026

View reviewed changes

guyathomas mentioned this pull request Apr 27, 2026

feat: token-based auth (replace deprecated email/password login) #334

Open

guyathomas mentioned this pull request Apr 27, 2026

feat: token-based auth (replace deprecated email/password login) guyathomas/qobuz-dl#1

Open

fix: handle None release_date_original in album metadata

15c551e

fix: prevent None DATE from crashing FLAC tagging

7ac828b

coderabbitai Bot mentioned this pull request May 31, 2026

Qobuz external provider bjarneo/cliamp#257

Open

2 tasks

paulborile mentioned this pull request Jun 8, 2026

plz fix this,thx! #330

Open

Conversation

paulborile commented Apr 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Usage

Uh oh!

flaviovivorio commented Apr 7, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

flaviovivorio commented Apr 7, 2026

Uh oh!

paulborile commented Apr 8, 2026

Uh oh!

flaviovivorio commented Apr 8, 2026

Uh oh!

Orald-0 commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

paulborile commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

SameOldAgony commented Apr 10, 2026

Uh oh!

anatosun commented Apr 10, 2026

Uh oh!

anatosun commented Apr 10, 2026

Uh oh!

CiaoBye commented Apr 10, 2026

Uh oh!

SameOldAgony commented Apr 10, 2026

Uh oh!

arena-andr commented Apr 11, 2026

Uh oh!

tenets-gamma commented Apr 13, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

jds-official commented Apr 17, 2026

Uh oh!

jds-official left a comment

Choose a reason for hiding this comment

Uh oh!

varris1 commented Apr 19, 2026

Uh oh!

NexusPenguin commented Jun 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

11 participants

paulborile commented Apr 5, 2026 •

edited

Loading

flaviovivorio commented Apr 7, 2026 •

edited

Loading

Orald-0 commented Apr 9, 2026 •

edited

Loading

paulborile commented Apr 9, 2026 •

edited

Loading

tenets-gamma commented Apr 13, 2026 •

edited

Loading