Unable to authenticate. 403 code about gspread HOT 23 CLOSED

btw. I'm using Python 2.7.1

from gspread.

It looks like the primary issue might be that your authentication schema is incorrect. in client.py, line 31-32 look like this:

AUTH_SERVER = 'https://www.google.com'
SPREADSHEETS_SERVER = 'spreadsheets.google.com'

While signing into a Google property takes me to this URL:

https://accounts.google.com/ServiceLogin

from gspread.

Or maybe not. I tried the official Google Python library and it gives me the same error. I don't get it. I've logged in successfully, then copied/pasted my credentials into the login method and still no joy. Is my pw supposed to be plain text in the login method call?

from gspread.

Looks like this was an issue with Google's two factor authorization. I'm submitting a pull request to update the docs for other's benefit.

from gspread.

#46

from gspread.

Great, many thanks for discovering this!

from gspread.

No problem. Your library works great.

from gspread.

Thank you

from gspread.

gdata does seem to work for me is I instead use an application-specific password from the two-factor authentication settings page...

from gspread.

It's happens to me too, but in my case, it was caused by login to google from a suspicious ip. so I login the online account and find google warn me with the message "We detected activity on your Google Account from a location you don't usually sign in from. Review the information below and tell us whether you recognize this activity". I can recognize that activity and it works. Thanks for the great library~

from gspread.

Thanks for sharing this!

from gspread.

gspread works fine for me with two factor authentication. You just need to create and use an application-specific password:

https://accounts.google.com/b/0/IssuedAuthSubTokens?hl=en_GB

Your username is your email as usual.

It is better this way anyway since your main user password is not used anywhere near your code, and the application specific password can be discarded/revoked independently.

from gspread.

@tcorbettclark Thanks for the finding!

from gspread.

You can also get a 403 error when Google thinks that your login is suspicious. I was logging in using a dedicated robot Google account from a Jenkins server hosted on Amazon EC2. I had to do two things:

• Mark the activity as not suspicious: https://security.google.com/settings/security/activity?hl=en&pli=1
• Bypass the capcha: http://www.google.com/accounts/DisplayUnlockCaptcha (thanks to http://serverfault.com/questions/550189/gmail-rejecting-imap-calls-from-aws-ec2-hosted-james-server#comment636128_550189 )

I hope this helps.

from gspread.

I came here looking for exactly the answer @tcorbettclark gave. It was my 2-factor auth. I had also been wondering how the heck I could get away from using my personal password in my script anyway.

Thanks!

from gspread.

@jwal .. thanks , you comment saved my time.

from gspread.

@jwal saves lifes.

from gspread.

To confirm & FYI:

I had the same "gspread.exceptions.AuthenticationError: Unable to authenticate. 403 code"

After the failed gspread logon, I immediately received a mail from Google/Gmail ([email protected]) in my gmail about a suspicous login attempt. I confirmed the login request was OK, and went to https://www.google.com/settings/security/lesssecureapps to accept lower-security apps to access my gmail account.

After that, the gspread login went OK.

PS: @burnash What a fantastic piece of software gspread is. Thank you very much!

from gspread.

thx @sanderjo

from gspread.

@sanderjo Thanks for the feedback 👍

from gspread.

@jwal Thanks for the helpful comment! The second step worked for me.

from gspread.

And one more update:

I got the 403 with another account I just created, and clicking on the URL https://www.google.com/settings/security/lesssecureapps did not solve it.

More digging revealed I had to also go to this URL: https://accounts.google.com/DisplayUnlockCaptcha, and after that I could use gspread.

FWIW: I put some extra logging into line 112 of gspread/client.py and that revealed this:

gspread.exceptions.AuthenticationError: Unable to authenticate. 403 code with content 
Error=BadAuthentication
Url=https://www.google.com/accounts/ContinueSignIn?blabla
Info=WebLoginRequired

Googling "Info=WebLoginRequired" led me to that URL https://accounts.google.com/DisplayUnlockCaptcha

HTH

from gspread.

Please update your GSpread API Reference.

The GSpread API Reference still says:

gspread.login(email, password)
Login to Google API using email and password.
This is a shortcut function which instantiates Client and performs login right away.
Returns: Client instance.

But, when I run it that way it says:
Warning:
ClientLogin is deprecated:
https://developers.google.com/identity/protocols/AuthForInstalledApps?csw=1
Authorization with email and password will stop working on April 20, 2015.

from gspread.