cyberjunky/python-garminconnect 0.3.20

Release 0.3.20

on GitHub

What's Changed

The mobile login works again. Since April it had been answering 429 on every attempt, which made every login fall back to the slower widget or portal strategies. This release also lets an MFA login be finished in another process.

Added

• Finish an MFA login in another process or on another server: with return_on_mfa=True, login() now returns ("needs_mfa", client_state). client_state is JSON-serializable, so a web app can store it while the user fetches the code, and finish the login later on a new Garmin instance with resume_login(client_state, code). That works across requests, restarts or servers, without asking Garmin for another code. The instance that started the login still uses its own session, so existing callers are unaffected. Tested live on a real account with the iOS and widget login flows. (#473)

  client_state contains Garmin session cookies, so store it as securely as a password and delete it once the login finishes. A restored state is accepted only for Garmin's own service URLs in its region.

  garmin = Garmin(email, password, return_on_mfa=True)
  status, client_state = garmin.login()
  # ...later, possibly in another process:
  Garmin().resume_login(client_state, mfa_code)

Fixed

• The mobile login works again: since April it posted the credentials straight to /mobile/api/login, without first loading the sign-in page as the iOS app does. Garmin answers such a request with 429 even when nothing is rate limited, so every login fell through to the widget or portal strategy. The sign-in page is loaded first again, with a short pause before the credentials are sent, and the mobile login succeeds on the first try. (#479)
• Logins blocked with HTTP 427 are reported as rate limits: Garmin's login pages have started answering some blocked attempts with the non-standard status 427. It counted as an ordinary failure, so a fully blocked login could surface as a generic connection error instead of GarminConnectTooManyRequestsError, and callers didn't back off. 427 is now treated like 429. (#477)

Development

• The unit tests no longer contact Garmin: about 40 login requests with fake credentials went to sso.garmin.com on every full test run, from the developer's IP, enough to get that IP rate-limited by Cloudflare. All network access is now blocked in unit tests. (#478)

Docs

• README: the demo and method counts are up to date (270 demo entries, 348 methods), the sample menu matches the demo, and the method reference moved above the Development section. (#472)

Thanks

• @SisyphusMD for cross-process MFA resumption (#473), live-tested before review.

Full Changelog: 0.3.19...0.3.20