New login endpoint

[normanr]

There's an endpoint at https://sso.chargepoint.com/api/v1/user/login that allows you to login with username and password and seems to be much easier to work with that the account.chargepoint.com endpoints. Might be worth switching to using it.

[Omnipius]

Do you have or have you located any documentation for that API? Can the token it returns be used to call the existing functions or would the API calls need to be completely changed?

[normanr]

No documentation. It's just the endpoint that the https://sso.chargepoint.com/ UI talks today today. It sets an auth-session cookie for .chargepoint.com which can be used to fetch the rest of the cookies (including coulomb_sess) via https://na.chargepoint.com/index.php/nghelper/getSession. As far as I know the rest of the API calls remain the same (I've only tested calls to https://mc.chargepoint.com/map-prod/v2)

[emonette123]

Has anybody really tried out the sso.chargepoint.com endpoint yet?

[Omnipius]

I tested out the flow suggested by @normanr tonight and it appears to be fully functional when calling the webservices API. I haven't tested setting the amperage limit via the internal API, but I'm encouraged enough to go rewrite the log in, log out, and set session token methods of the ChargePoint client class for full up testing.

PS: I'm working in a personal fork right now. Let me know if I should switch to a branch back here.

[emonette123]

If you place your work somewhere I can access, I will gladly help you test. I am using that API through AppDaemon.

[Omnipius]

OK, it took some experimenting to figure out how to get a log lived coulomb_sess token on demand, but it turned out to be deceptively simple. I haven't tested the actual implementation yet, but I'm going to get a draft PR going that'll link to my code for comment and testing.

[emonette123]

Testing your login, I get an access blocked. Here are the debug logs:

DEBUG: Discovering account region for username emonette123
DEBUG: Discovered account region: NA-CA / Canada (CA)
DEBUG: Attempting client login with user: emonette123 at https://sso-ca.chargepoint.com/api/v1/user/login
DEBUG: {'datadome': 'MPK3xd63QKLX08CWNgstNKvDuI5Ub5rSfXgaPCDWugPs2Jj1O2DW5j1haplTDSDAVwHa9no5JDYR68KFptIjvlcUDGq8EwhJXs9CwLbroVmzQYxW_Hfy_ekFsZu9FNB'}
DEBUG: {'Date': 'Wed, 01 Oct 2025 15:48:11 GMT', 'Content-Type': 'application/json;charset=utf-8', 'Content-Length': '456', 'Connection': 'keep-alive', 'CF-RAY': '987d1a51b8efac46-YYZ', 'Access-Control-Allow-Origin': '*', 'Cache-Control': 'max-age=0, private, no-cache, no-store, must-revalidate', 'Set-Cookie': 'datadome=MPK3xd63QKLX08CWNgstNKvDuI5Ub5rSfXgaPCDWugPs2Jj1O2DW5j1haplTDSDAVwHa9no5JDYR68KFptIjvlcUDGq8EwhJXs9CwLbroVmzQYxW_Hfy_ekFsZu9FNB; Max-Age=31536000; Domain=.chargepoint.com; Path=/; Secure; SameSite=Lax', 'Pragma': 'no-cache', 'Accept-CH': 'Sec-CH-UA,Sec-CH-UA-Mobile,Sec-CH-UA-Platform,Sec-CH-UA-Arch,Sec-CH-UA-Full-Version-List,Sec-CH-UA-Model,Sec-CH-Device-Memory', 'Access-Control-Allow-Credentials': 'true', 'Access-Control-Expose-Headers': 'x-dd-b, x-set-cookie', 'Charset': 'utf-8', 'X-DataDome': 'protected', 'X-DataDome-CID': 'AHrlqAAAAAMA0VPk2E0IJiwAqZbMZA==', 'X-DD-B': '2', 'Vary': 'Accept-Encoding', 'Strict-Transport-Security': 'max-age=31536000; includeSubDomains', 'Server': 'cloudflare'}
ERROR: Failed to get auth token! status_code=403 err={"url":"https://geo.captcha-delivery.com/captcha/?initialCid=AHrlqAAAAAMA0VPk2E0IJiwAqZbMZA==&cid=MPK3xd~63QKLX08CWNgstNKvDuI5Ub5rSfXgaPCDWugPs2Jj1O2DW5j1haplTDSDAVwHa9no5JDYR68KFptIjvlcUDGq8EwhJXs9CwLbroVmzQYxW_Hfy_ekFsZu9FNB&referer=https%3A%2F%2Fsso-ca.chargepoint.com%2Fapi%2Fv1%2Fuser%2Flogin&hash=C2675704EFE363D0C7EFE7F17F5FCD&t=bv&s=37720&e=a09c83838b3fa144bf98e0d0f3a08401d665b420c9566db659a75f651b5df0f3feb76fa0b922e6c8f3a0445187a81cef&b=347303"}

The geo.captcha-delivery.com basically says Access blocked, we detected unusual activity from your device or network. I tried through a vpn and got the same error, from a different network. Is it possible the sso login is enabled for some regions, but it is blocked in Canada? In which region are you located?

I just tried with a different freshly created account, same error... Annoying.

Just posted my username and password using curl same error.

[Omnipius]

A similar thing happened to me. See recent comments on the PR. I've added the ability to init with an auth-session token, which you can intercept during web login using developer tools in your browser.

I'm looking into whether or not we can send the user to complete the captcha and login on CP's side and automate grabbing that token, at least as part of the HA config flow.