# Keys for logging onto and using the athom-api

**URL:** <https://community.homey.app/t/keys-for-logging-onto-and-using-the-athom-api/34582>\
**Category:** Developers\
**Created:** [September 11, 2020, 11:32am UTC](https://community.homey.app/t/keys-for-logging-onto-and-using-the-athom-api/34582 "2020-09-11T11:32:43Z")\
**Posts on this page:** 9\
**Page:** 1

<div class="post-metadata">

**Author:** ![Ragnar](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/ragnar/32/18145_2.png) [@Ragnar](https://community.homey.app/u/Ragnar)\
**Post date:** [September 11, 2020, 11:32am UTC](https://community.homey.app/t/keys-for-logging-onto-and-using-the-athom-api/34582/1 "2020-09-11T11:32:43Z")

</div>

I’m trying to acquire the keys for logging onto and using the athom-api. I’m trying to do the steps programmatically. Im meeting some resistance.

I’ve been using posts on a different thread. Especially [posts 30 by @Niels](https://community.homey.app/t/unsupported-homey-v2-rest-api/7268/30) and [47 by @Lammy](https://community.homey.app/t/unsupported-homey-v2-rest-api/7268/47) which are comprehensive and inspiring. Thank you!

Using python:

```
import requests as rq
import json as json

# Step 1: Authentication. JWT with credentials.
url = 'https://accounts.athom.com/login'
lgn = {'email':'##@##.##', 'password':'##'}
jwt = rq.post(url, data=lgn)

# Step 2: Authorization. Obtain a delegation code. The HTTP result should be a 302 (redirect)
# Step 2a: Using the homey.ink client credentials
client_id = '5cbb504da1fc782009f52e46'
client_secret = 'gvhs0gebgir8vz8yo2l0jfb49u9xzzhrkuo1uvs8'
redirect_uri = 'https://homey.ink/login.html'

user_token = json.loads(jwt.text)['token']
url = f"https://accounts.athom.com/authorise?client_id={client_id}&redirect_uri={redirect_uri}&response_type=code&user_token={user_token}"
rsp = rq.get(url)

# Step 2b: Sending allaw access form
rescource = "resource.homey.##"
pos_of_csrf = rsp.text.find('input type="hidden" name="_csrf" value="') + 40
_csrf = rsp.text[pos_of_csrf:pos_of_csrf+36] # _csrf is 36chars

form_data = f"resource={rescource}&_csrf={_csrf}&allow=Allow" 
headers = {'Content-Type': 'application/x-www-form-urlencoded'}
rsp_with_device = rq.post(url, data=form_data, headers=headers)

code = rsp_with_device.url.split('=')[1] # Code in the redirect-url

# Step 3: Get an access token
# -- To be continued --

```

Step 1 works fine.  
Step 2 now works fine.  
Step 3 Is unfinished.

**Note:** I’m updating this original post as I’m solving the issues I’m encountering. This is because the end goal is to be able to log onto the athom-api and I figure this is the best way to show my current progress when posting questions.

---

<div class="post-metadata">

**Author:** ![Lammy](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/lammy/32/11436_2.png) [@Lammy](https://community.homey.app/u/Lammy)\
**Post date:** [September 11, 2020, 1:43pm UTC](https://community.homey.app/t/keys-for-logging-onto-and-using-the-athom-api/34582/2 "2020-09-11T13:43:33Z")

</div>

Hi Ragnar, the second step uses the GET method. Seems you do a POST.

---

<div class="post-metadata">

**Author:** ![Ragnar](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/ragnar/32/18145_2.png) [@Ragnar](https://community.homey.app/u/Ragnar)\
**Post date:** [September 11, 2020, 2:13pm UTC](https://community.homey.app/t/keys-for-logging-onto-and-using-the-athom-api/34582/3 "2020-09-11T14:13:06Z")

</div>

Ok. My bad there, Thanks!, but doing a _get_ returns the html document for the authorization. Not a redirect to a delegation code. I’ll update the initial question to keep it on track for the topic “getting keys…”

---

<div class="post-metadata">

**Author:** ![Lammy](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/lammy/32/11436_2.png) [@Lammy](https://community.homey.app/u/Lammy)\
**Post date:** [September 11, 2020, 3:17pm UTC](https://community.homey.app/t/keys-for-logging-onto-and-using-the-athom-api/34582/4 "2020-09-11T15:17:49Z")

</div>

Did you see my second post in [[Unsupported] Homey v2 REST API](https://community.homey.app/t/unsupported-homey-v2-rest-api/7268/49)?  
In short, the returned html in step 2 contains a form, fill it and POST it. That will give you the 302 and the delegation code in the headers.

---

<div class="post-metadata">

**Author:** ![Ragnar](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/ragnar/32/18145_2.png) [@Ragnar](https://community.homey.app/u/Ragnar)\
**Post date:** [September 11, 2020, 3:44pm UTC](https://community.homey.app/t/keys-for-logging-onto-and-using-the-athom-api/34582/5 "2020-09-11T15:44:31Z")

</div>

I saw this, and I have identified the \_csrf and resource values, but couldnt figure out how to post them.

A curl example would be useful since I’m still quite rookie on the technical part 🙂

---

<div class="post-metadata">

**Author:** ![Lammy](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/lammy/32/11436_2.png) [@Lammy](https://community.homey.app/u/Lammy)\
**Post date:** [September 13, 2020, 8:37am UTC](https://community.homey.app/t/keys-for-logging-onto-and-using-the-athom-api/34582/6 "2020-09-13T08:37:39Z")

</div>

I don’t use curl that often, so I would have to look up the details.  
What you should do is:  
Add this header: _Content-Type: application/x-www-form-urlencoded_  
Put this in form fields:  
_client\_id=[your client id]_  
_client\_secret=[your client secret]_  
_grant\_type=authorization\_code_  
_code=[the delegation code]_  
and (with https) post it to: _[api.athom.com/oauth2/token](http://api.athom.com/oauth2/token)_  
That will give you the _refresh\_token_ and _access\_token_ in json.

With curl it should be something like:  
`curl -X POST 'Content-Type: application/x-www-form-urlencoded' -F 'client_secret=<your client secret>' -F 'client_secret=<your client secret>' -F 'grant_type=authorization_code' -F 'code=<the delegation code>' https:// api.athom.com/oauth2/token`

-X tells curl to send X-Form data.  
-F is followed by a form field  
-H is followed by a header

Maybe I missed something with curl, but that shouldn’t be too hard to find.

---

<div class="post-metadata">

**Author:** ![Ragnar](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/ragnar/32/18145_2.png) [@Ragnar](https://community.homey.app/u/Ragnar)\
**Post date:** [September 14, 2020, 8:41am UTC](https://community.homey.app/t/keys-for-logging-onto-and-using-the-athom-api/34582/7 "2020-09-14T08:41:29Z")

</div>

Thanks! But the question still remains on how to programmatically reproduce what happens when I press “Allow”.

A form like `"resource=resource.homey.###&_csrf=###&allow=Allow"` seems to be posted to the url resulting in a 302 redirect to the url containing the code. But how is \_csrf obtained? It has a short lifespan and is not the same as the one saved to the session cookie.

 ![Capture2](https://us1.discourse-cdn.com/flex025/uploads/athom/original/3X/9/7/9772a23c50f1c3251e5ce4ea3836345428413f6a.png)

Have you done this? If so, how did you solve it?

---

<div class="post-metadata">

**Author:** ![Ragnar](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/ragnar/32/18145_2.png) [@Ragnar](https://community.homey.app/u/Ragnar)\
**Post date:** [September 14, 2020, 9:46am UTC](https://community.homey.app/t/keys-for-logging-onto-and-using-the-athom-api/34582/8 "2020-09-14T09:46:51Z")

</div>

@Lammy, Ive had some progress obtaining the code. By using the \_csrf from the html, I was able to successfully post the form and receive the delegation code. Using python:

```
rescource = "resource.homey.###" 
pos_of_csrf = responds.text.find('input type="hidden" name="_csrf" value="') + 40
_csrf = rsp.text[pos_of_csrf:pos_of_csrf+36]
 
form_data = f"resource={rescource}&_csrf={_csrf}&allow=Allow"  
headers = {'Content-Type': 'application/x-www-form-urlencoded'}
rsp_with_device = rq.post(url2, data=form_data, headers=headers)

code = rsp_with_device.url.split('=')[1]

```

I’ll continue experimenting with this towards [api.athom.com](http://api.athom.com). Thanks this far for the assist! Im sure Ill have some more questions as I continue [on your steps in the other post](https://community.homey.app/t/unsupported-homey-v2-rest-api/7268/47).

---

<div class="post-metadata">

**Author:** ![Lammy](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/lammy/32/11436_2.png) [@Lammy](https://community.homey.app/u/Lammy)\
**Post date:** [September 27, 2020, 7:42am UTC](https://community.homey.app/t/keys-for-logging-onto-and-using-the-athom-api/34582/9 "2020-09-27T07:42:48Z")

</div>

Good work. The way to find these things is indeed to use the developer mode in your browser. Login manually with your browser and monitor the traffic. In some cases you may need to set a few breakpoints, for example when data is exchanged with Java, or when you browser follows a redirect.  
If a certain step in your code doesn’t work, have a look at the returned body. Often it contains a JSON error explanation.  
I still have to write code to parse ‘chunked bodies’. As long as I don’t get this intermittent form to post (say Step 2b) I have little incentive to do so 😉.