Keep getting TgtgLoginError: (403, b'{"url":"https://geo.captcha-delivery.com/interstitial/[...])

[tomkor96]

Hello,
I noticed that from 16.11.2025 my e-mail notifier app keep getting this error:

Details:

• Python version: 3.14 / 3.11.2
• OS: Windows 11 / Linux raspberrypi 6.12.47+rpt-rpi-v8 create action workflow #1 SMP PREEMPT Debian 1:6.12.47-1+rpt1~bookworm (2025-09-16) aarch64
• tgtg: Using version 25.11.0 (both Windows 11 and Linux)

---------------------------------------------------------------------------
TgtgLoginError                            Traceback (most recent call last)
Cell In[2], [line 2](vscode-notebook-cell:?execution_count=2&line=2)
      1 client = TgtgClient(email="myemail@gmail.com")
----> [2](vscode-notebook-cell:?execution_count=2&line=2) credentials = client.get_credentials()

File c:\Users\tomas\AppData\Local\Programs\Python\Python314\Lib\site-packages\tgtg\__init__.py:91, in TgtgClient.get_credentials(self)
     90 def get_credentials(self):
---> [91](file:///C:/Users/tomas/AppData/Local/Programs/Python/Python314/Lib/site-packages/tgtg/__init__.py:91)     self.login()
     92     return {
     93         "access_token": self.access_token,
     94         "refresh_token": self.refresh_token,
     95         "cookie": self.cookie,
     96     }

File c:\Users\tomas\AppData\Local\Programs\Python\Python314\Lib\site-packages\tgtg\__init__.py:178, in TgtgClient.login(self)
    174     raise TgtgAPIError(
    175         response.status_code, "Too many requests. Try again later."
    176     )
    177 else:
--> [178](file:///C:/Users/tomas/AppData/Local/Programs/Python/Python314/Lib/site-packages/tgtg/__init__.py:178)     raise TgtgLoginError(response.status_code, response.content)

TgtgLoginError: (403, b'{"url":"[https://geo.captcha-delivery.com/interstitial/[...])

What I tried to do:

• turned off notifier for 1 day to check if my IP isn't blocked,
• used VPN to send requests form different IP's.

Could you please let me know if this is known problem for now? I can't find any information about it at GitHub recently

Kind regards
Tomek

[reidmeyer]

same

[antonioli86]

Same here. :(
@ahivert - any update?

[blowk]

Datadome cookie prevent it. See #369

[cmjr86]

Any update?

[HanBarn]

Any update?

It looks like the issue with the 403 captcha is back again.
I had no problems at all for weeks. Coincidence?

[Klausoleum]

Hello everyone,

First of all, thank you very much for this project and for making it available on GitHub. I've been able to use it for a long time.

I'd like to ask if it's technically possible (or planned) to integrate DataDome support into this repository. Specifically, I'm interested in whether DataDome's security mechanisms (such as cookie management or SDK-based validation) could be integrated into this project.

I tried the idea described here:
https://www.cereal-automation.com/blog/datadome-tgtg-api

Unfortunately, this approach doesn't give me working cookie values.

[tomkor96]

Hello everyone,

First of all, thank you very much for this project and for making it available on GitHub. I've been able to use it for a long time.

I'd like to ask if it's technically possible (or planned) to integrate DataDome support into this repository. Specifically, I'm interested in whether DataDome's security mechanisms (such as cookie management or SDK-based validation) could be integrated into this project.

I tried the idea described here:
https://www.cereal-automation.com/blog/datadome-tgtg-api

Unfortunately, this approach doesn't give me working cookie values.

Same for me, I have also tried using datadome cookies but still getting 403 responses.

[Klausoleum]

Overnight, I've at least managed to develop a small part of a promising solution.

This module allows you to retrieve a DatadomeCookie and test it during login attempts using an email address.
No capture or 403 error is generated. Instead, you receive a registration email from tgtg.
From this, I conclude that it works perfectly.

Now, this "just" needs to be integrated into the entire project. I haven't had time for that yet.

For me, the most important thing was to see if there's a way to communicate with the API without 403 errors.
Note: This is just a small test, not intended to be elegant code ;) Night work

First you need to get a cookie:
TakeCookie.py

import httpx
import time
import json

def get_datadome_cookie():
    url = "https://api-sdk.datadome.co/sdk/"
    current_ms = int(time.time() * 1000)
    
    headers = {
        "User-Agent": "okhttp/5.1.0",
        "Content-Type": "application/x-www-form-urlencoded",
        "Accept": "*/*",
        "Accept-Encoding": "gzip"
    }

    payload = {
        "cid": "a1b2c3d4e5f6g7h8i9j0k1l2m3n4o5p6q7r8s9t0u1v2w3x4y5z6a7b8c9d0e1f2",
        "ddk": "1D42C2CA6131C526E09F294FE96F94",
        "request": "api.toogoodtogo.com",
        "ua": "TGTG/23.11.2 Dalvik/2.1.0 (Linux; U; Android 14; Pixel 7 Pro Build/UQ1A.240105.004)",
        "events": json.dumps([{"id": 1, "message": "response validation", "source": "sdk", "date": current_ms}]),
        "inte": "android-java-okhttp",
        "ddv": "3.0.4",
        "ddvc": "23.11.2",
        "os": "Android",
        "osr": "14",
        "osn": "UPSIDE_DOWN_CAKE",
        "osv": "34",
        "screen_x": "1440",
        "screen_y": "3120",
        "screen_d": "3.5",
        "camera": '{"auth":"true", "info":"{\\"front\\":\\"2000x1500\\",\\"back\\":\\"5472x3648\\"}"}',
        "mdl": "Pixel 7 Pro",
        "prd": "Pixel 7 Pro",
        "mnf": "Google",
        "dev": "cheetah",
        "hrd": "GS201",
        "fgp": "google/cheetah/cheetah:14/UQ1A.240105.004/10814564:user/release-keys",
        "tgs": "release-keys",
        "d_ifv": "9f8e7d6c5b4a3f2e1d0c9b8a7f6e5d4c"
    }

    try:
        # Nutzung von HTTP/2 wie von okhttp 5.1.0 erwartet
        with httpx.Client(http2=True, timeout=15.0) as client:
            print(f"[{time.strftime('%H:%M:%S')}] Sende Request...")
            response = client.post(url, data=payload, headers=headers)
            
            print(f"Status Code: {response.status_code}")
            
            # 1. Alle Header ausgeben (wichtig für Set-Cookie)
            print("\n--- RESPONSE HEADERS ---")
            for key, value in response.headers.items():
                print(f"{key}: {value}")
            
            # 2. Den Body ausgeben (hier steht oft der Grund der Ablehnung)
            print("\n--- RESPONSE BODY ---")
            print(response.text)
            
            datadome_cookie = response.cookies.get("datadome")
           

    except Exception as e:
        print(f"Fehler: {e}")

if __name__ == "__main__":
    get_datadome_cookie()

[Klausoleum]

Then you can insert all the characters of the cookie here and don't forget your email address in the code.

EMailLoginWithCookie.py

import httpx
import time

def login_to_tgtg(cookie_value, email_address):
    login_url = "https://api.toogoodtogo.com/api/auth/v5/authByEmail"

    headers = {
        "Content-Type": "application/json",
        "User-Agent": "TGTG/23.11.2 Dalvik/2.1.0 (Linux; U; Android 14; Pixel 7 Pro Build/UQ1A.240105.004)",
        "Cookie": f"datadome={cookie_value}"
    }

    payload = {
        "device_type": "ANDROID",
        "email": email_address
    }

    print(f"[{time.strftime('%H:%M:%S')}] POST {login_url}")
    print("Payload:", payload)
    print("Cookie Header:", headers["Cookie"])

    with httpx.Client(http2=True, timeout=15) as client:
        response = client.post(login_url, json=payload, headers=headers)

    print("Status:", response.status_code)
    print("Response:", response.text)
    return response


if __name__ == "__main__":
  
    MY_COOKIE_VALUE = (
        "YOUR_COOKIE_VALUE_FROM_RETURN_OF_TAKECOOKIE.py" 
        #All characters after datadome... datadome="CookieValue"
    )

    USER_EMAIL = "YOUR-EMAIL-ADDRESS"

    login_to_tgtg(MY_COOKIE_VALUE, USER_EMAIL)

[blowk]

Hello everyone,

First of all, thank you very much for this project and for making it available on GitHub. I've been able to use it for a long time.

I'd like to ask if it's technically possible (or planned) to integrate DataDome support into this repository. Specifically, I'm interested in whether DataDome's security mechanisms (such as cookie management or SDK-based validation) could be integrated into this project.

I tried the idea described here: https://www.cereal-automation.com/blog/datadome-tgtg-api

Unfortunately, this approach doesn't give me working cookie values.

I've also tried, but got stuck on authentication. Authentication by email doesn't work good with the link in it to verify. It checks from which device is was send. I've tried the authenticate with pincode that also was send in the e-mail, but there I got stuck to obtain the right cookies and got 403 message.

[Klausoleum]

Okay, I've gotten that far too.
The link won't open on a device without the TGTG app.

It doesn't work on a device with the app either.

Where did you enter the PIN code?

[blowk]

When you recieve the e-mail, there is also a pin code that's included.
Normally you could send it to 'auth/v5/authByRequestPin' and request should include deviceType, email, requestPin and requestPollingId.
I didn't figure it out completely because after that I getting the 400 without the tokens.

[Klausoleum]

This method is/was not yet implemented in the repository.

I will continue trying and report back.

[Klausoleum]

On my quick attempt, I got a 400 error.

400 - {"errors":[{"code":"UNAUTHORIZED","message":"Request failed. CorrelationId: 284d46ae-8656-4799-9f4d-9ef5c5214705"}]}

                    
    def login(self):
            if not (self.email or self.access_token and self.refresh_token and self.cookie):
                raise TypeError(
                    "You must provide at least email or access_token, refresh_token and cookie"
                )
            
            if self._already_logged:
                self._refresh_token()
                return

            # Schritt 1: Login-E-Mail triggern
            response = self.session.post(
                self._get_url(AUTH_BY_EMAIL_ENDPOINT),
                headers=self._headers,
                json={
                    "device_type": self.device_type,
                    "email": self.email,
                },
                proxies=self.proxies,
                timeout=self.timeout,
            )

            if response.status_code == HTTPStatus.OK:
                login_data = response.json()
                
                if login_data.get("state") == "WAIT":
                    polling_id = login_data.get("polling_id")
                    
                    # --- HIER IST DAS INPUT-FELD ---
                    print(f"\n[!] Eine E-Mail wurde an {self.email} gesendet.")
                    user_pin = input(">>> Bitte gib die 6-stellige PIN aus der E-Mail ein: ").strip()
                    
                    # Schritt 2: PIN absenden
                    self._submit_pin(user_pin, polling_id)
                
                elif login_data.get("state") == "TERMS":
                    raise TgtgPollingError("Dieser Account existiert nicht. Bitte erst registrieren.")
            else:
                raise TgtgLoginError(response.status_code, response.content)

    def _submit_pin(self, pin, polling_id):


        current_headers = self._headers.copy()
        if "Cookie" in current_headers:
            del current_headers["Cookie"]

        payload = {
            "device_type": self.device_type,
            "email": self.email,
            "request_polling_id": polling_id,
            "pin": str(pin).strip()
        }
        
        response = self.session.post(
            self._get_url(AUTH_BY_PIN_ENDPOINT),
            headers=current_headers, 
            json=payload,
            proxies=self.proxies,
            timeout=self.timeout,
        )

        if response.status_code == HTTPStatus.OK:
            sys.stdout.write("Erfolgreich mit PIN eingeloggt!\n")
            login_response = response.json()
            self.access_token = login_response["access_token"]
            self.refresh_token = login_response["refresh_token"]
            self.last_time_token_refreshed = datetime.datetime.now()
            
            if "Set-Cookie" in response.headers:
                self.cookie = response.headers["Set-Cookie"]
        else:
            print(f"Fehler-Details: {response.status_code} - {response.text}")
            raise TgtgLoginError(response.status_code, response.content)

[blowk]

Here is an example in Kotlin https://github.com/Cereal-Automation/Script-Monitoring/tree/master/command-monitoring%2Fsrc%2Fmain%2Fkotlin%2Fcom%2Fcereal%2Fcommand%2Fmonitor%2Fdata%2Ftgtg%2Fapiclients but I don't understand how to obtain datadome cookie.
Do you need to create a new datadome cookie with every request?