nathom
[BUG] Tidal OAUTH2 failing because of "invalid_client" error
Describe the bug
When I tried downloading tracks from Tidal, the token refresh failed with this error. After resetting the config, it still kept happening, and now I can't even log in again. A couple of days ago, I logged in for the first time in streamrip.
Command Used
rip url https://tidal.com/album/221735022/u
Debug Traceback
[21:19:30] DEBUG Showing all debug logs cli.py:111
DEBUG Removing dirs set() artwork.py:19
╭──────────────────────────── Traceback (most recent call last) ─────────────────────────────╮
│ /home/thies/.local/bin/rip:7 in <module> │
│ │
│ 4 if __name__ == '__main__': │
│ 5 │ if sys.argv[0].endswith('.exe'): │
│ 6 │ │ sys.argv[0] = sys.argv[0][:-4] │
│ ❱ 7 │ sys.exit(rip()) │
│ 8 │
│ │
│ ╭──────────── locals ─────────────╮ │
│ │ rip = <HelpColorsGroup rip> │ │
│ │ sys = <module 'sys' (built-in)> │ │
│ ╰─────────────────────────────────╯ │
│ │
│ /usr/lib/python3.13/site-packages/click/core.py:1442 in __call__ │
│ │
│ /usr/lib/python3.13/site-packages/click/core.py:1363 in main │
│ │
│ /usr/lib/python3.13/site-packages/click/core.py:1830 in invoke │
│ │
│ /usr/lib/python3.13/site-packages/click/core.py:1226 in invoke │
│ │
│ /usr/lib/python3.13/site-packages/click/core.py:794 in invoke │
│ │
│ /usr/lib/python3.13/site-packages/click/decorators.py:34 in new_func │
│ │
│ /home/thies/.local/lib/python3.13/site-packages/streamrip/rip/cli.py:29 in wrapper │
│ │
│ 26 def coro(f): │
│ 27 │ @wraps(f) │
│ 28 │ def wrapper(*args, **kwargs): │
│ ❱ 29 │ │ return asyncio.run(f(*args, **kwargs)) │
│ 30 │ │
│ 31 │ return wrapper │
│ 32 │
│ │
│ ╭────────────────────────── locals ───────────────────────────╮ │
│ │ args = (<click.core.Context object at 0x7fc69eba0e10>,) │ │
│ │ kwargs = {'urls': ('https://tidal.com/album/221735022/u',)} │ │
│ ╰─────────────────────────────────────────────────────────────╯ │
│ │
│ /usr/lib/python3.13/asyncio/runners.py:195 in run │
│ │
│ 192 │ │ │ "asyncio.run() cannot be called from a running event loop") │
│ 193 │ │
│ 194 │ with Runner(debug=debug, loop_factory=loop_factory) as runner: │
│ ❱ 195 │ │ return runner.run(main) │
│ 196 │
│ 197 │
│ 198 def _cancel_all_tasks(loop): │
│ │
│ ╭───────────────────────────── locals ─────────────────────────────╮ │
│ │ debug = None │ │
│ │ loop_factory = None │ │
│ │ main = <coroutine object url at 0x7fc69edd7810> │ │
│ │ runner = <asyncio.runners.Runner object at 0x7fc69eb9c830> │ │
│ ╰──────────────────────────────────────────────────────────────────╯ │
│ │
│ /usr/lib/python3.13/asyncio/runners.py:118 in run │
│ │
│ 115 │ │ │
│ 116 │ │ self._interrupt_count = 0 │
│ 117 │ │ try: │
│ ❱ 118 │ │ │ return self._loop.run_until_complete(task) │
│ 119 │ │ except exceptions.CancelledError: │
│ 120 │ │ │ if self._interrupt_count > 0: │
│ 121 │ │ │ │ uncancel = getattr(task, "uncancel", None) │
│ │
│ ╭──────────────────────────────────────── locals ────────────────────────────────────────╮ │
│ │ context = <_contextvars.Context object at 0x7fc6a0deec00> │ │
│ │ coro = <coroutine object url at 0x7fc69edd7810> │ │
│ │ self = <asyncio.runners.Runner object at 0x7fc69eb9c830> │ │
│ │ sigint_handler = functools.partial(<bound method Runner._on_sigint of │ │
│ │ <asyncio.runners.Runner object at 0x7fc69eb9c830>>, main_task=<Task │ │
│ │ finished name='Task-1' coro=<url() done, defined at │ │
│ │ /home/thies/.local/lib/python3.13/site-packages/streamrip/rip/cli.py… │ │
│ │ exception=Exception("Device authorization failed {'status': 401, │ │
│ │ 'error': 'invalid_client', 'sub_status': 1005, 'error_description': │ │
│ │ 'Client with token zU4XHVVkc2tDPo4t not found'}")>) │ │
│ │ task = <Task finished name='Task-1' coro=<url() done, defined at │ │
│ │ /home/thies/.local/lib/python3.13/site-packages/streamrip/rip/cli.py… │ │
│ │ exception=Exception("Device authorization failed {'status': 401, │ │
│ │ 'error': 'invalid_client', 'sub_status': 1005, 'error_description': │ │
│ │ 'Client with token zU4XHVVkc2tDPo4t not found'}")> │ │
│ ╰────────────────────────────────────────────────────────────────────────────────────────╯ │
│ │
│ /usr/lib/python3.13/asyncio/base_events.py:725 in run_until_complete │
│ │
│ 722 │ │ if not future.done(): │
│ 723 │ │ │ raise RuntimeError('Event loop stopped before Future completed.') │
│ 724 │ │ │
│ ❱ 725 │ │ return future.result() │
│ 726 │ │
│ 727 │ def stop(self): │
│ 728 │ │ """Stop running the event loop. │
│ │
│ ╭──────────────────────────────────────── locals ────────────────────────────────────────╮ │
│ │ future = <Task finished name='Task-1' coro=<url() done, defined at │ │
│ │ /home/thies/.local/lib/python3.13/site-packages/streamrip/rip/cli.py:167> │ │
│ │ exception=Exception("Device authorization failed {'status': 401, 'error': │ │
│ │ 'invalid_client', 'sub_status': 1005, 'error_description': 'Client with │ │
│ │ token zU4XHVVkc2tDPo4t not found'}")> │ │
│ │ new_task = False │ │
│ │ self = <_UnixSelectorEventLoop running=False closed=True debug=False> │ │
│ ╰────────────────────────────────────────────────────────────────────────────────────────╯ │
│ │
│ /home/thies/.local/lib/python3.13/site-packages/streamrip/rip/cli.py:191 in url │
│ │
│ 188 │ │ │ │ version_coro = None │
│ 189 │ │ │ │
│ 190 │ │ │ async with Main(cfg) as main: │
│ ❱ 191 │ │ │ │ await main.add_all(urls) │
│ 192 │ │ │ │ await main.resolve() │
│ 193 │ │ │ │ await main.rip() │
│ 194 │
│ │
│ ╭──────────────────────────────────────── locals ────────────────────────────────────────╮ │
│ │ cfg = <streamrip.config.Config object at 0x7fc69eb9c590> │ │
│ │ ctx = <click.core.Context object at 0x7fc69eba0e10> │ │
│ │ main = <streamrip.rip.main.Main object at 0x7fc69eb9da90> │ │
│ │ updates = True │ │
│ │ urls = ('https://tidal.com/album/221735022/u',) │ │
│ │ version_coro = <Task finished name='Task-2' coro=<latest_streamrip_version() done, │ │
│ │ defined at │ │
│ │ /home/thies/.local/lib/python3.13/site-packages/streamrip/rip/cli.py:4… │ │
│ │ result=('2.1.0', None)> │ │
│ ╰────────────────────────────────────────────────────────────────────────────────────────╯ │
│ │
│ /home/thies/.local/lib/python3.13/site-packages/streamrip/rip/main.py:124 in add_all │
│ │
│ 121 │ │ │ │ │ f"[red]Found invalid url [cyan]{urls[i]}[/cyan], skipping.", │
│ 122 │ │ │ │ ) │
│ 123 │ │ │ │ continue │
│ ❱ 124 │ │ │ url_client_pairs.append((p, await self.get_logged_in_client(p.source))) │
│ 125 │ │ │
│ 126 │ │ pendings = await asyncio.gather( │
│ 127 │ │ │ *[ │
│ │
│ ╭────────────────────────────────────── locals ──────────────────────────────────────╮ │
│ │ i = 0 │ │
│ │ p = <streamrip.rip.parse_url.GenericURL object at 0x7fc69eb9ee40> │ │
│ │ parsed = [<streamrip.rip.parse_url.GenericURL object at 0x7fc69eb9ee40>] │ │
│ │ self = <streamrip.rip.main.Main object at 0x7fc69eb9da90> │ │
│ │ url_client_pairs = [] │ │
│ │ urls = ('https://tidal.com/album/221735022/u',) │ │
│ ╰────────────────────────────────────────────────────────────────────────────────────╯ │
│ │
│ /home/thies/.local/lib/python3.13/site-packages/streamrip/rip/main.py:145 in │
│ get_logged_in_client │
│ │
│ 142 │ │ │ prompter = get_prompter(client, self.config) │
│ 143 │ │ │ if not prompter.has_creds(): │
│ 144 │ │ │ │ # Get credentials from user and log into client │
│ ❱ 145 │ │ │ │ await prompter.prompt_and_login() │
│ 146 │ │ │ │ prompter.save() │
│ 147 │ │ │ else: │
│ 148 │ │ │ │ with console.status(f"[cyan]Logging into {source}", spinner="dots"): │
│ │
│ ╭────────────────────────────────── locals ──────────────────────────────────╮ │
│ │ client = <streamrip.client.tidal.TidalClient object at 0x7fc69eb9dd30> │ │
│ │ prompter = <streamrip.rip.prompter.TidalPrompter object at 0x7fc69eb9ef90> │ │
│ │ self = <streamrip.rip.main.Main object at 0x7fc69eb9da90> │ │
│ │ source = 'tidal' │ │
│ ╰────────────────────────────────────────────────────────────────────────────╯ │
│ │
│ /home/thies/.local/lib/python3.13/site-packages/streamrip/rip/prompter.py:101 in │
│ prompt_and_login │
│ │
│ 98 │ │ return len(self.config.session.tidal.access_token) > 0 │
│ 99 │ │
│ 100 │ async def prompt_and_login(self): │
│ ❱ 101 │ │ device_code, uri = await self.client._get_device_code() │
│ 102 │ │ login_link = f"https://{uri}" │
│ 103 │ │ │
│ 104 │ │ console.print( │
│ │
│ ╭──────────────────────────────── locals ────────────────────────────────╮ │
│ │ self = <streamrip.rip.prompter.TidalPrompter object at 0x7fc69eb9ef90> │ │
│ ╰────────────────────────────────────────────────────────────────────────╯ │
│ │
│ /home/thies/.local/lib/python3.13/site-packages/streamrip/client/tidal.py:324 in │
│ _get_device_code │
│ │
│ 321 │ │ resp = await self._api_post(f"{AUTH_URL}/device_authorization", data) │
│ 322 │ │ │
│ 323 │ │ if resp.get("status", 200) != 200: │
│ ❱ 324 │ │ │ raise Exception(f"Device authorization failed {resp}") │
│ 325 │ │ │
│ 326 │ │ return resp["deviceCode"], resp["verificationUriComplete"] │
│ 327 │
│ │
│ ╭──────────────────────────────────── locals ────────────────────────────────────╮ │
│ │ data = {'client_id': 'zU4XHVVkc2tDPo4t', 'scope': 'r_usr+w_usr+w_sub'} │ │
│ │ resp = { │ │
│ │ │ 'status': 401, │ │
│ │ │ 'error': 'invalid_client', │ │
│ │ │ 'sub_status': 1005, │ │
│ │ │ 'error_description': 'Client with token zU4XHVVkc2tDPo4t not found' │ │
│ │ } │ │
│ │ self = <streamrip.client.tidal.TidalClient object at 0x7fc69eb9dd30> │ │
│ ╰────────────────────────────────────────────────────────────────────────────────╯ │
╰────────────────────────────────────────────────────────────────────────────────────────────╯
Exception: Device authorization failed {'status': 401, 'error': 'invalid_client',
'sub_status': 1005, 'error_description': 'Client with token zU4XHVVkc2tDPo4t not found'}
Config File
[downloads]
# Folder where tracks are downloaded to
folder = "/home/thies/StreamripDownloads"
# Put Qobuz albums in a 'Qobuz' folder, Tidal albums in 'Tidal' etc.
source_subdirectories = false
# Put tracks in an album with 2 or more discs into a subfolder named `Disc N`
disc_subdirectories = true
# Download (and convert) tracks all at once, instead of sequentially.
# If you are converting the tracks, or have fast internet, this will
# substantially improve processing speed.
concurrency = true
# The maximum number of tracks to download at once
# If you have very fast internet, you will benefit from a higher value,
# A value that is too high for your bandwidth may cause slowdowns
# Set to -1 for no limit
max_connections = 6
# Max number of API requests per source to handle per minute
# Set to -1 for no limit
requests_per_minute = 60
# Verify SSL certificates for API connections
# Set to false if you encounter SSL certificate verification errors (not recommended)
verify_ssl = true
[qobuz]
# 1: 320kbps MP3, 2: 16/44.1, 3: 24/<=96, 4: 24/>=96
quality = 3
# This will download booklet pdfs that are included with some albums
download_booklets = true
# Authenticate to Qobuz using auth token? Value can be true/false only
use_auth_token = false
# Enter your userid if the above use_auth_token is set to true, else enter your email
email_or_userid = ""
# Enter your auth token if the above use_auth_token is set to true, else enter the md5 hash of your plaintext password
password_or_token = ""
# Do not change
app_id = ""
# Do not change
secrets = []
[tidal]
# 0: 256kbps AAC, 1: 320kbps AAC, 2: 16/44.1 "HiFi" FLAC, 3: 24/44.1 "MQA" FLAC
quality = 3
# This will download videos included in Video Albums.
download_videos = true
# Do not change any of the fields below
user_id = ""
country_code = ""
access_token = ""
refresh_token = ""
# Tokens last 1 week after refresh. This is the Unix timestamp of the expiration
# time. If you haven't used streamrip in more than a week, you may have to log
# in again using `rip config --tidal`
token_expiry = ""
[deezer]
# 0, 1, or 2
# This only applies to paid Deezer subscriptions. Those using deezloader
# are automatically limited to quality = 1
quality = 2
# An authentication cookie that allows streamrip to use your Deezer account
# See https://github.com/nathom/streamrip/wiki/Finding-Your-Deezer-ARL-Cookie
# for instructions on how to find this
arl = ""
# This allows for free 320kbps MP3 downloads from Deezer
# If an arl is provided, deezloader is never used
use_deezloader = true
# This warns you when the paid deezer account is not logged in and rip falls
# back to deezloader, which is unreliable
deezloader_warnings = true
[soundcloud]
# Only 0 is available for now
quality = 0
# This changes periodically, so it needs to be updated
client_id = ""
app_version = ""
[youtube]
# Only 0 is available for now
quality = 0
# Download the video along with the audio
download_videos = false
# The path to download the videos to
video_downloads_folder = "/home/thies/StreamripDownloads/YouTubeVideos"
[database]
# Create a database that contains all the track IDs downloaded so far
# Any time a track logged in the database is requested, it is skipped
# This can be disabled temporarily with the --no-db flag
downloads_enabled = true
# Path to the downloads database
downloads_path = "/home/thies/.config/streamrip/downloads.db"
# If a download fails, the item ID is stored here. Then, `rip repair` can be
# called to retry the downloads
failed_downloads_enabled = true
failed_downloads_path = "/home/thies/.config/streamrip/failed_downloads.db"
# Convert tracks to a codec after downloading them.
[conversion]
enabled = false
# FLAC, ALAC, OPUS, MP3, VORBIS, or AAC
codec = "ALAC"
# In Hz. Tracks are downsampled if their sampling rate is greater than this.
# Value of 48000 is recommended to maximize quality and minimize space
sampling_rate = 48000
# Only 16 and 24 are available. It is only applied when the bit depth is higher
# than this value.
bit_depth = 24
# Only applicable for lossy codecs
lossy_bitrate = 320
# Filter a Qobuz artist's discography. Set to 'true' to turn on a filter.
# This will also be applied to other sources, but is not guaranteed to work correctly
[qobuz_filters]
# Remove Collectors Editions, live recordings, etc.
extras = false
# Picks the highest quality out of albums with identical titles.
repeats = false
# Remove EPs and Singles
non_albums = false
# Remove albums whose artist is not the one requested
features = false
# Skip non studio albums
non_studio_albums = false
# Only download remastered albums
non_remaster = false
[artwork]
# Write the image to the audio file
embed = true
# The size of the artwork to embed. Options: thumbnail, small, large, original.
# "original" images can be up to 30MB, and may fail embedding.
# Using "large" is recommended.
embed_size = "large"
# If this is set to a value > 0, max(width, height) of the embedded art will be set to this value in pixels
# Proportions of the image will remain the same
embed_max_width = -1
# Save the cover image at the highest quality as a seperate jpg file
save_artwork = true
# If this is set to a value > 0, max(width, height) of the saved art will be set to this value in pixels
# Proportions of the image will remain the same
saved_max_width = -1
[metadata]
# Sets the value of the 'ALBUM' field in the metadata to the playlist's name.
# This is useful if your music library software organizes tracks based on album name.
set_playlist_to_album = true
# If part of a playlist, sets the `tracknumber` field in the metadata to the track's
# position in the playlist instead of its position in its album
renumber_playlist_tracks = true
# The following metadata tags won't be applied
# See https://github.com/nathom/streamrip/wiki/Metadata-Tag-Names for more info
exclude = []
# Changes the folder and file names generated by streamrip.
[filepaths]
# Create folders for single tracks within the downloads directory using the folder_format
# template
add_singles_to_folder = false
# Available keys: "albumartist", "title", "year", "bit_depth", "sampling_rate",
# "id", and "albumcomposer"
folder_format = "{albumartist} - {title} ({year}) [{container}] [{bit_depth}B-{sampling_rate}kHz]"
# Available keys: "tracknumber", "artist", "albumartist", "composer", "title",
# and "albumcomposer", "explicit"
track_format = "{tracknumber:02}. {artist} - {title}{explicit}"
# Only allow printable ASCII characters in filenames.
restrict_characters = false
# Truncate the filename if it is greater than this number of characters
# Setting this to false may cause downloads to fail on some systems
truncate_to = 120
# Last.fm playlists are downloaded by searching for the titles of the tracks
[lastfm]
# The source on which to search for the tracks.
source = "qobuz"
# If no results were found with the primary source, the item is searched for
# on this one.
fallback_source = ""
[cli]
# Print "Downloading {Album name}" etc. to screen
text_output = true
# Show resolve, download progress bars
progress_bars = true
# The maximum number of search results to show in the interactive menu
max_search_results = 100
[misc]
# Metadata to identify this config file. Do not change.
version = "2.0.6"
# Print a message if a new version of streamrip is available
check_for_updates = true
Operating System
Linux
streamrip version
2.1.0
Screenshots and recordings
https://asciinema.org/a/WKlRhsdrARHWM8kNM5ciQNSfJ
Additional context
No response
edit: others basically came up with exactly the same thing I did over in #896
I did a little digging into this and found that Tidal has revoked the application-level API token for streamrip. Even if you were able to prompt for reauthentication with rip config --tidal (doesn't seem to actually be a valid command), you'd run into the same error message regarding the invalid token before even being prompted to reauthenticate.
Exception: Device authorization failed {'status': 401, 'error': 'invalid_client', 'sub_status': 1005, 'error_description': 'Client with token zU4XHVVkc2tDPo4t not found'}
The issue can be temporarily resolved by updating the CLIENT_ID and CLIENT_SECRET in /usr/lib/python3.13/site-packages/streamrip/client/tidal.py (lines 21-24) with valid credentials.
The client credentials are base64-encoded in streamrip/client/tidal.py:
- Line 21: CLIENT_ID
- Line 22-24: CLIENT_SECRET
These credentials need to be replaced with valid ones that Tidal hasn't revoked. However, obtaining valid Tidal API credentials requires either registering as a developer with Tidal or having access to legitimate credentials through other means. I confirmed that replacing the token with a valid one works.
The proper long-term solution would be for the streamrip maintainers to obtain and update to a new official Tidal client token in the repository. ~I'm not sure how likely this is given their developer token was revoked -- it depends on the reason why.~ Seems token rotation might be a fairly normal affair, so may just be a matter of one of the maintainers actually updating it or someone with a Tidal dev account submitting a PR
I have tidal working on my fork. Manifest parsing approach taken from Tiddl as reference. Thanks to the author for spending the time to get that to work.
https://github.com/omnunum/streamrip/pull/10
Shouldn't be too hard to port over to here if the maintainer wants to. Keep in mind I change my fork willy nilly for my own personal needs so I don't promise any type of non-breaking backwards compatibility that the author here would.
Same issue here. Thank you @vvdbx for digging into this. I am not sure how to update CLIENT_ID and CLIENT_SECRET myself, but I am happy we know where the issue is taking place.
https://github.com/nathom/streamrip/issues/899#issuecomment-3508235901
try my method.
edit: others basically came up with exactly the same thing I did over in #896 I did a little digging into this and found that Tidal has revoked the application-level API token for streamrip. Even if you were able to prompt for reauthentication with
rip config --tidal(doesn't seem to actually be a valid command), you'd run into the same error message regarding the invalid token before even being prompted to reauthenticate.Exception: Device authorization failed {'status': 401, 'error': 'invalid_client', 'sub_status': 1005, 'error_description': 'Client with token zU4XHVVkc2tDPo4t not found'}The issue can be temporarily resolved by updating the CLIENT_ID and CLIENT_SECRET in /usr/lib/python3.13/site-packages/streamrip/client/tidal.py (lines 21-24) with valid credentials.
The client credentials are base64-encoded in streamrip/client/tidal.py:
- Line 21: CLIENT_ID
- Line 22-24: CLIENT_SECRET
These credentials need to be replaced with valid ones that Tidal hasn't revoked. However, obtaining valid Tidal API credentials requires either registering as a developer with Tidal or having access to legitimate credentials through other means. I confirmed that replacing the token with a valid one works.
The proper long-term solution would be for the streamrip maintainers to obtain and update to a new official Tidal client token in the repository. ~I'm not sure how likely this is given their developer token was revoked -- it depends on the reason why.~ Seems token rotation might be a fairly normal affair, so may just be a matter of one of the maintainers actually updating it or someone with a Tidal dev account submitting a PR
I tried using generated client ID and client secret from tidal developer app I created, but still it doesn't work. I encoded the client ID in base64, but it seems the client secret tidal provides is already encoded.
I have tidal working on my fork. Manifest parsing approach taken from Tiddl as reference. Thanks to the author for spending the time to get that to work.
Shouldn't be too hard to port over to here if the maintainer wants to. Keep in mind I change my fork willy nilly for my own personal needs so I don't promise any type of non-breaking backwards compatibility that the author here would.
Thanks dude. I copied your code and it works!