Personal Access Token stopped working

@nayelyz, I had a ticket open with ST support and their Tier 2 pointed me to the community for the same problem. The token below was created in January 2021 and was working but has stopped. What are the steps to troubleshoot a PAT that has stopped working?

Hi, @Forrest. Welcome to the SmartThings Community!

Are you trying to make a request that requires the scopes whitelisted for your token?
I see it doesn’t include all of them, this means some calls to the API can fail if your token doesn’t have the required scope whitelisted.

For example, I see it allows you to read all of your locations. Do you get an error if you try to query your locations?

Hi, it is a 401 error, it is like the token just stopped being accepted:

I am trying to operate the same door control device that has worked previously with this PAT

Is this for the Home Assistant integration?
Because there’s a new integration for this: New Integration Between Home Assistant and SmartThings

I don’t know if this is related to the issue where HA lost access and you had to do some workarounds to get it back, but that was before they released the new version. So, I would say you can check that out first because it should work better.

This is not related to HA but is annApple shortcuts. The execution works perfectly with a new PAT just not with the one that has been working before. I would just use a new token except it will expire in 24 hours instead of the 46 years my current token should have.

OK, I’ll open a report on this. To do so, I need the following, please:

  1. Do you get the error while configuring the Apple shortcut or when you’re trying to execute its function?
  2. We need your help replicating the issue and taking the time when you did. Then share it with us including your timezone. For example: 14:00GMT-6. This is to find the error log.
  3. Open support access to your account:
    1. Confirm the email account registered in the forum is the same one you use for SmartThings. If not, please share it with me over DM
    2. Enable support access to your account:
  1. Go to the SmartThings Web (my.smartthings.com)
  2. Log in to your Samsung Account
  3. Select Menu (â‹®) and choose Settings
  4. Toggle on Account Data Access
  5. Select the time period and confirm - In this step, please select “Until turned off”, Once the team finishes, we’ll let you know so you can disable it again.

If you have questions about this access please go to this article.

Thank you for your help with this. as far as responses to your inquiries:

  1. I get the error when executing not when setting it up.
  2. I’ve just had it execute again and received the 401 error at 19:19 GMT+5.
  3. Support access is enabled until turned off and is through the same account for both.
1 Like

Hi, @Forrest

Following up on this issue, you mentioned your shortcut is intended to control your door control, right?
Is it only a direct command to open/close, or are you calling an automatic Routine or manual routine (scene)?
Did the exact same configuration use to work in the past?

The engineering team mentioned that if you can see your token on the Tokens’ page, it should still be valid, so, we just want to validate the request being done because we didn’t find any logs that correspond to the time frame you mentioned.
I saw your device that has the doorControl capability is “Z-Wave Garage Door Opener”, I also tried to find logs about a command sent to it in the time frame you mentioned and found nothing.

@nayelyz Comments:

  1. yes it is a direct command (JSON) that is send to the device via the API
  2. The configuration works today with a new token that expires in 24 hrs. It just doesn’t work with my existing token (results in a 401). It is clear that the token is not performing as expected even though it has the correct (as far as I can tell) permissions and should still be vaild:

Below is the experiment I have performed (All screenshots 14-APR and times are UTC-5 New York/EST Time Zone). The only change between the 2 tests is to update the PAT id in the
underlying ST_Device_CMD_API

Using New Token
Checking underlying Shortcut with “New Test Token” (begins with 4d) generated today

  1. See failure is only on malformed request in this first screenshot, access was granted (no 401) this is OK for this Shortcut. This one needs to be called from the Child Shortcut (next screenshot)

  2. Call to Garage door successful (and I can confirm it actually opened)

Using Original Token
Checking underlying Shortcut with “Versa” (begins with 42) generated in January 2021

  1. See failure is access related, the token is not being accepted (i.e. 401)

  1. Since command controller failed, no surprise calling the child Shortcut failed

Hi, @Forrest

When did you do the tests with the “original token”, today April 14th, at 10:06 am? This is just to find the command in the logs.

Yes, for the original token the API calls would have been would have been between 10:05 and 10:08 AM EST.

Hi, @Forrest

We’re seeing only the success calls from the new token, so, to remove one layer that might be blocking the execution, we need your help to test the token with a direct command to the API instead of the shortcuts.

For this, please help us setting up the SmartThings CLI. Here are the instructions: Get Started With the SmartThings CLI | Developer Documentation | SmartThings

Then, run the command below:

smartthings devices --token=…

Replace the “…” with the actual Personal Access Token.
Please let me know if you have any questions about this.

Please see response with legacy token

Hi, @Forrest

So, the engineering team found the error log about this, and it says the token you’re using isn’t valid. However, we don’t know the reason, so, we’re wondering if you’re using the correct value because in my tests, this issue happens when we omit/change a digit in the PAT as well.
The PAT must be a uuid: 32 hexadecimal characters and 4 hyphens for a 36 total characters.