Document the new auth system

[timdorr]

This is a restart of #215, which has become quite noisy and off topic. If you are looking for help with an implementation or library/tool that uses the API, please use the Discussion board here on GitHub.

Tesla has switched to using a separate SSO service (auth.tesla.com) for their app and website. This replaces the previous password grant that was directly on the Owner API. They have also added MFA support with TOTP authenticators.

I've updated the Ruby library with support for login and token refresh, but need to add MFA support. The docs are completely missing as of this moment. Let's do this!

• Document new login mechanism
  • Document MFA path
• Document refreshing an access token
• Implement MFA support in Ruby library

[timdorr]

I've updated for the new login mechanism: https://tesla-api.timdorr.com/api-basics/authentication

I'm still missing the MFA bits and am working on the refresh token process right now. Please let me know if there are any mistakes. PRs are welcome!

[alandtse]

Thanks for documenting this. In my testing of step3, you can't use the base64 encoded version of code_verifier. Are you sure? When I tested with that version I ran into

{
"error": "invalid_request", 
"error_description": "Invalid code_verifier", 
"error_uri": "https://auth.tesla.com/error/reference/baabcc7-5c60-43b9-be7c-40a23f7129b1-1612044611898"}

I don't have the error if I use the unencoded version.

[timdorr]

@alandtse Yep, that's an error on my part. Fixed it up now. Good catch!

[ekmekcioglu]

Added JS implementation of oauth2 for v3 with MFA support
The JS code is in my post #263

[Dreamsorcerer]

If I'm reading the steps correctly, refreshing tokens only works on the initial 5 min tokens? Which presumably requires refreshing within 10 mins of getting the token.

Is there no known way to refresh on a longer term basis? A 10 min refresh period is pretty much unusable for most applications, so we'd end up with the user needing to login again every 45 days, when the access token expires.

[timdorr]

There is only a 5 minute time limit on the bearer token, which you should be immediately exchanging for an access token on the Owner API. The refresh token is always long-lived and works until you use it, even after access token expiration.

[Dreamsorcerer]

Perfect, thanks.