get_session.py returns Authentication failed every time

[BojidarTonev]

I believe there has been an udpate in the twitter API, sicne now everytime i try to use the get_session.py with correct credentials I get Authenticaiton failed. each time - am I the only here stumbling on this issue?

Status Code: 400
'code': 399,
'message': 'LoginError.AttestationDenied'

This is a device attestation error - Twitter is detecting that the request is not coming from a real Android device and blocking it.

[josephanwar2]

same issue when using the official twitter app on emulator, but working normally on real phone

[tlgsn]

+1

[ganesh-RW]

same issue , +1

[akuma0]

Same here...
Musk plan to remove Twitter domain to replace it by X
It's maybe related to this ? https://x.com/Safety/status/1981764501947953225

[tahafatih]

Same here... Musk plan to remove Twitter domain to replace it by X It's maybe related to this ? https://x.com/Safety/status/1981764501947953225

No, this issue is related to integrity. Twitter now verifies whether the device it's installed on is trustworthy. It doesn't allow rooted devices or patched apps into the emulator.

[josephanwar2]

Same here... Musk plan to remove Twitter domain to replace it by X It's maybe related to this ? https://x.com/Safety/status/1981764501947953225

No, this issue is related to integrity. Twitter now verifies whether the device it's installed on is trustworthy. It doesn't allow rooted devices or patched apps into the emulator.

yes that's right
have you any idea to bypass this verify

[tahafatih]

Same here... Musk plan to remove Twitter domain to replace it by X It's maybe related to this ? https://x.com/Safety/status/1981764501947953225

No, this issue is related to integrity. Twitter now verifies whether the device it's installed on is trustworthy. It doesn't allow rooted devices or patched apps into the emulator.

yes that's right have you any idea to bypass this verify

You can try Magisk.

[josephanwar2]

Same here... Musk plan to remove Twitter domain to replace it by X It's maybe related to this ? https://x.com/Safety/status/1981764501947953225

No, this issue is related to integrity. Twitter now verifies whether the device it's installed on is trustworthy. It doesn't allow rooted devices or patched apps into the emulator.

yes that's right have you any idea to bypass this verify

You can try Magisk.

tried it with no success
did you try it?

[cmj]

It seems they are implementing something like this https://developer.apple.com/documentation/devicecheck/preparing-to-use-the-app-attest-service

I can still grab cookies, but oauth tokens via any method is a struggle to find a solution to. If you're seeing this error and trying to grab cookies; use the 'forgot password' option and re-enter your old password; that will at least re-enable access to the account.

Per a recent tweet, they seem to be actively trying to kill off the old domain (twitter.com) and in the process remove old methods of onboarding. If this is the case, cookies usage may only be the way forward.

[0xbarchitect]

I got the same issue.
Do you have any solution yet?

[AZthemute]

Same issue here.

How can I grab cookies?

[0xcathiefish]

It seems that trying to pass the anti-bot detection is tough.

I reverted to using the earlier website authorization method to get the OAuth token and secret, which requires you to complete the authorization on a real user device.

As an alternative, this works but inconvenient. You have to log in to each account manually in Chrome, then authorize it in the website to get the token.

Looking forward to a smarter way...

[josephanwar2]

It seems that trying to pass the anti-bot detection is tough.

I reverted to using the earlier website authorization method to get the OAuth token and secret, which requires you to complete the authorization on a real user device.

As an alternative, this works but inconvenient. You have to log in to each account manually in Chrome, then authorize it in the website to get the token.

Looking forward to a smarter way...

Hi,
"then authorize it in the website to get the token."
what is the website you talking about?

[0xcathiefish]

It seems that trying to pass the anti-bot detection is tough.
I reverted to using the earlier website authorization method to get the OAuth token and secret, which requires you to complete the authorization on a real user device.
As an alternative, this works but inconvenient. You have to log in to each account manually in Chrome, then authorize it in the website to get the token.
Looking forward to a smarter way...

Hi, "then authorize it in the website to get the token." what is the website you talking about?

My method is to self-host an application that uses the official OAuth 1.0 flow. Once you authorize the App with your Twitter account, the backend captures the access token and secret.

It's just really inconvenient that you have to open the authorization link on an actual device, like in Chrome, for it to work.

If you really need this workaround as an althernative, I'm glad to share this simple Python file I forked from an official Twitter script.

[Mostafa3mad]

It seems that trying to pass the anti-bot detection is tough.
I reverted to using the earlier website authorization method to get the OAuth token and secret, which requires you to complete the authorization on a real user device.
As an alternative, this works but inconvenient. You have to log in to each account manually in Chrome, then authorize it in the website to get the token.
Looking forward to a smarter way...

Hi, "then authorize it in the website to get the token." what is the website you talking about?

My method is to self-host an application that uses the official OAuth 1.0 flow. Once you authorize the App with your Twitter account, the backend captures the access token and secret.

It's just really inconvenient that you have to open the authorization link on an actual device, like in Chrome, for it to work.

If you really need this workaround as an althernative, I'm glad to share this simple Python file I forked from an official Twitter script.

Hi, thanks for the explanation.
I'm very interested in the workaround you mentioned.
If possible, could you please share the Python file?
Thanks in advance!