400 Bad Request error when using oauth, but browser authentication works

[AntitrustEnthusiast]

Describe the bug
the ytmusic.search() command is throwing a HTTP 400: Bad Request error with the message Request contains an invalid argument, but only when using oauth. Browser authentication works fine.

Using ytmusicapi version 1.8.2

To Reproduce
Steps to reproduce the behavior:

1. run ytmusicapi oauth as documented in setup
2. Minimal script example:

from ytmusicapi import YTMusic

conn = YTMusic("oauth.json")
search_result = conn.search(f"It's beginning to look a lot like Christmas")

Result:

Traceback (most recent call last):
  File "C:\dev\ytmusic\test.py", line 4, in <module>
    search_result = conn.search(f"It's beginning to look a lot like Christmas")
                    ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\dev\ytmusic\venv\Lib\site-packages\ytmusicapi\mixins\search.py", line 183, in search
    response = self._send_request(endpoint, body)
               ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "C:\dev\ytmusic\venv\Lib\site-packages\ytmusicapi\ytmusic.py", line 241, in _send_request
    raise YTMusicServerError(message + error)
ytmusicapi.exceptions.YTMusicServerError: Server returned HTTP 400: Bad Request.
Request contains an invalid argument.

Additional context
I've been using it for quite a while without issue, but today it stopped working, seemingly at random. Switching to browser auth has temporarily fixed it for my workflow.

Deleting oauth.json and redoing the authentication flow didn't work either.

[zostay]

I too have started getting this, though, I can't get the browser auth to work either.

[aseel743]

Did oauth.json creation work in your case?
Could you help me out if it did?

[sigma67]

Could you try messing with the headers to see if removing some fixes it? Hard to tell what the issue is without further indication

[AntitrustEnthusiast]

Hmm, I ran test requests using this code:

from ytmusicapi import YTMusic
conn = YTMusic("oauth.json")
conn.rate_song("A4zBSnMhvI0", "LIKE")

While removing one of these headers each time:

• user-agent
• accept
• accept-encoding
• content-type
• content-encoding
• origin
• authorization
• X-Goog-Request-Time

All of them except authorization returned the exact same error message: Request contains an invalid argument.

Here's the full error from the API, in case it helps:

{
  "error": {
    "code": 400,
    "message": "Request contains an invalid argument.",
    "errors": [
      {
        "message": "Request contains an invalid argument.",
        "domain": "global",
        "reason": "badRequest"
      }
    ],
    "status": "INVALID_ARGUMENT"
  }
}

Also tried removing ?alt=json from the endpoint, no change.

The only one that had a different result was removing the authentication header, which returned a You must be signed in to perform this operation. error.

[rafaeldrrmachado]

Does anyone know where the oauth.json file is stored? I can't findi it to try and delete it

[srajangarg]

same issue, commenting for visibility!

guessing its a server side change that break the api

[AntitrustEnthusiast]

Someone in the linked spotify_to_ytmusic issue mentioned it works for them as Manager of their family plan, but not for their wife and kids (non-managers).

I am in the same situation (non-manager), is everyone else experiencing the issue also a non-manager on a family plan?

[hhh4hn]

everyone else experiencing the issue also a non-manager on a family plan?

This seems related to what I've noticed: it's working fine for me when using oauth creds for one account that is a primary account of mine, but it does not work on another which is a "brand account" under a second account. I get 400: Bad Request on any call using that brand account.

Edit: on further testing, it seems like my 2nd account (which is under a family plan), whether I use its primary or brand account, fail with this error, so my experience supports @AntitrustEnthusiast hypothesis.

[apastel]

everyone else experiencing the issue also a non-manager on a family plan?

My account is the manager of my family plan and I get the 400: Bad Request error when using oauth creds.

[sabad67]

i am seeing this issue as a manager of a family plan.

[soreikomori]

Same here when calling yt.get_history(). I also tried updating to no avail. Currently on ver. 1.8.2.

[sigma67]

I doubt this is related to family plans, likely just a coincidence.

I would suspect that something in here broke/needs to be updated due the server-side update: https://github.com/sigma67/ytmusicapi/blob/main/ytmusicapi/helpers.py

I will try comparing our requests with the current requests on the web when I find time. Unfortunately I work a full time job so it might be a few days. I certainly recognize the importance of the issue given the number of reports.

In the meantime, anyone else with the time can perform the same analysis!

[secnonsense]

I have an individual plan and am also seeing this error. Maybe the issue is due to having multiple accounts on the plan? In my instance I use a branded account instead of my primary gmail.com account. I saw the error using my branded account, however after regenerating my oauth.json using my gmail.com account everything worked as expected.

[Batwam]

I'm also getting this HTTP 400 error for the last few days. Glad to see I'm not alone. I tried to generate oauth.json from 2 separate accounts and both of them fail.

[apastel]

We're all well aware that the issue is happening, now it's time for the open-source community to do its thing and come together and fix it. If you scroll up and read @sigma67's message, you'll see they are busy and some suggestions about where to look in the meantime. It's probably some header or something that changed on one of the requests in the oauth flow. I tried looking at the API docs for OAuth 2.0 for TV and Limited-Input Device Applications but nothing stuck out as being different. Also tried going through the oauth flow in the browser and looking at the requests/responses to see if there's anything that looks like one of the requests in the helpers.py file, but I might just be looking in the wrong place. The properties in oauth.json itself seem to match exactly what's expected according to that API document...

[abetwothree]

Seeing same issue. Tried multiple accounts and it all fails locally and on a server. However, it does work locally without an oauth.json file.

[Batwam]

same here, works with browser authentications, the instructions are here: https://ytmusicapi.readthedocs.io/en/stable/setup/browser.html

Is this authentication method going to have to be renewed regularly?

[sigma67]

Common advice to make long-lasting cookies is to create them using the browser's in-private session. This avoids accidentally messing with the session during your regular browsing activity

The cookies last quite long in my experience

[Batwam]

that's good to know, thanks

[Hengen42]

I couldn't manage to get cookies in the brave browser. I keep getting a 401 error.

[Hengen42]

"te": "trailers\u001a"

I solved the issue by removing this code from the browser.json file. However, I've been struggling with it for hours. It was so silly.
Example: (In the empty space, there is ["te": "trailers\u001a".] but it needs to be removed.)

{
    "accept": "",
    "accept-encoding": "",
    "accept-language": "",
    "authorization": "",
    "connection": "",
    "content-encoding": "",
    "content-type": "",
    "cookie": "",
    "origin": "",
    "priority": "",
    "referer": "",

    "user-agent": "",
    "x-goog-authuser": "",
    "x-goog-visitor-id": "",
    "x-kl-ajax-request": "",
    "x-origin": "",
    "x-youtube-bootstrap-logged-in": "",
    "x-youtube-client-name": "",
    "x-youtube-client-version": ""
}

[zostay]

I had trouble pasting directly into the ytmusicapi. My terminal choked on the long Cookie header line. The fix is easy though. Paste to a file and then:

ytmusicapi browser < headers.txt

I suspect ytmusicapi browser needs to disable some tty limit, but this works fine. I record it here in case anyone else had this problem.

[apastel]

Are you running on macOS by chance?

source: https://ytmusicapi.readthedocs.io/en/stable/setup/browser.html

[PriyanshVerma]

@zostay , can you share what format does your headers.txt file look llike? Is it of the form:

accept
/
accept-encoding
gzip, deflate, br, zstd
accept-language
en-US,en;q=0.9

^ meaning the keys and values of each key-value pair on a separate line? Or something else?

Note that I'm getting the above format when I've copied over the request headers from Chrome Inspect and pasted them into a VSCode tab.

[jooker]

I have my browser.json file by following the instructions at https://ytmusicapi.readthedocs.io/en/stable/setup/browser.html now how do I use it to authenticate to use the s2yt_gui and get rid of the bad request?

I dont mind using the terminal if I cant use the gui but I cant seem to find anything on using the browser.json.

[fischcode]

It looks like the maintainers of the YouTube Kodi plugin https://github.com/anxdpanic/plugin.video.youtube found a solution - at least it is playing all of a few videos I tested. I haven't quite figured out how, but it appears to be related to using the right tokens in the right place.

[fischcode]

Managed to get ytmusicapi working again with oauth by using a personal Google (developer) API key, client id and client secret in constants.py. You can manage these in https://console.cloud.google.com/apis/credentials; there are a number of tutorials on the intnernet how to create your own API key, client id and client secret.

[sigma67]

Might be a good idea to change the current oauth CLI to one that asks for client id and secret?

[fischcode]

I am very sorry, but I just realize it's quite a bit more complicated than I thought:
My successful test was done with an external OAuth implementation (from Kodi addon ytmusic.exp, https://github.com/Goldenfreddy0703/plugin.audio.ytmusic.exp) for token management and not using ytmusicapi's the OAuth implementation: With the ytmusicapi OAuth client, I can only successfully run get_home() but neither get_library_songs() nor get_library_subscriptions(): Both of the latter calls result in an exception: ytmusicapi.exceptions.YTMusicServerError: Server returned HTTP 401: Unauthorized.
Haven't found the time yet to track down the relevant difference between the two OAuth implementations...

[sigma67]

@fischcode they are only using a static copy of ytmusicapi, I doubt they have changed much?

[fischcode]

Sorry again, my tests were flawed - in fact, ytmusicapi works fine when supplied with an oauth token created with a valid client id and client secret. I have therefore created pull request #688 to add parameters for using your own client id and client secret to ytmusicapi setup.

[wolfeinkc]

I've been struggling with oauth and browser credentials for days, and haven't been able to get authorized with oauth or get past the browser header setup.
I've created a TV and Limited Input Oauth 2 client ID as per the instructions. Then I've run "ytmusicapi oauth" and allowed access. But, the credentials in the terminal output don't match the client ID and secret of my Google credential. I've tried passing both sets in to the YTMusic constructor, but I always get an error that I'm not authorized.
I've tried every combination I can think of with browser authentication, but receive an authentication error, or an error that I'm missing the cookie and x-goog-authuser values.
Is there a way to get more detailed instructions for either or both authentication procedures?

[sigma67]

@wolfeinkc are you sure you're using 1.9.0? With the latest version you need to pass the credentials to ytmusicapi oauth as well.

If your are using an older version then the wrong credentials could be used which don't work anymore.

You also need to make sure to pass the correct OAuth file which you created with your own credentials. Make sure that it's not the old one you used previously.

And make sure YT Data API is enabled for your project in Google Cloud Console (if you created credentials it should be, just making sure)

[flatypus]

Neither oauth.json nor browser.json works for me now.
Using the manual cookie pasting method for browser.json, i'm getting:
ytmusicapi.exceptions.YTMusicServerError: Server returned HTTP 401: Unauthorized.
When I try using the oauth.json method, i'm just getting
ytmusicapi.exceptions.YTMusicServerError: Server returned HTTP 400: Bad Request. Request contains an invalid argument.
I am also on the latest (1.9.0) version.

[apastel]

This is perhaps a dumb question (but not that dumb)...

When setting up oauth using the new method that requires client_id and client_secret, is it the expectation that I as an application developer would create a single OAuth App in my Google Cloud Platform project, and that's what all the downstream users of my app would use?

For some reason I initially was thinking that every user of my application would need to create their own project in their Google Cloud Platform and set up the OAuth credentials themselves. But now I'm realizing that doesn't make much sense, and it's probably the case that my application would just already user the client_id and client_secret of "MyApp" so that users don't have to do anything except log in. I of course would have to take care to not expose the client_id and secret in my app, somehow... (maybe using GitHub Secrets?)

So yeah. If you have an app that uses ytmusicapi, does every user make their own OAuth 2.0 client or is their one single OAuth 2.0 client per application? As somebody who has done work with OAuth professionally, I'm pretty sure it's the latter but I just wasn't thinking about this the right way initially...

[sigma67]

No, it's a valid question. Usually you want the user to add the project for themselves. If you add it you will run into API quotas quickly if you have any significant amount of users. So every user is their own OAuth 2.0 client.

see also how Kodi does it, you have to provide the id & secret: https://github.com/anxdpanic/plugin.video.youtube/wiki/Personal-API-Keys

[sigma67]

If you want you can add a note to the documentation on this, I'm sure you're not the only one with this question

[PriyanshVerma]

Browser auth did not work ~2 months ago, but then worked ~1 month ago, but now does not work again. Could this be a relic of whatever global rollout is being talked about in the comments? Sorry, I don't fully understand what that global rollout is expected to impact.

In any case, I'm using the steps described for browser auth on a mac:

1. Network tab -> Request Headers -> copying everything starting accept
2. pbpaste | ytmusicapi browser

This step 2 errors out for me saying:

Exception: The following entries are missing in your headers: x-goog-authuser, cookie. Please try a different request (such as /browse) and make sure you are logged in.

But, the copied over headers I have do indeed contain cookie and x-goog-authuser!

Anyone facing this in browser auth? Any help here is appreciated!