Two-Step Verification on Garmin Accounts

[iggbom]

Anyone know if there's a way to handle that?

[philosowaffle]

02/04/2023 Edit: See #410 for progress updates
02/12/2023 Edit: See marked answer for solution

original:
I honestly didn't even know Peloton offered 2fa. Is it done via an Email/Texted TOTP or can you use any app (like Authenticator) for generating the code?

[johnnybirdman]

@iggbom, thank you for the info. I gave it a try but unfortunately it says that it’s “permanent”… unless you know how to get around that too?

[iggbom]

@johnnybirdman I don't but looks like maybe it's related to what device you have associated with your Garmin account? You got an ECG enabled device?

https://forums.garmin.com/apps-software/mobile-apps-web/f/garmin-connect-web/321912/permanent-two-step-verification

[johnnybirdman]

Yes, I have ECG working on the Venu 2 Plus. I tried to uninstall the ECG app as well, but that didn’t seem to change anything.

[jsnrthmp]

I just spoke with Garmin support. The permanent 2FA is due to the ECG app. As they release it for more watches, this will become more prevalent. They will not/are not able to reverse the setting, even if you remove the app.

[jsnrthmp]

The authentication can be completed via email

[philosowaffle]

1month and 1600 modified lines of code later.... and I think I have this working good enough to hand off to y'all 🎉

If you find a problem please reach out on this thread.

Notes on Two-Step:

1. You will not be able to use the GitHub Action option anymore, you'll have to switch to one of the other install options
2. If you run the Docker Console image, it needs to be run in Interactive -i mode (example command)
3. You will not be able to enable automatic/background syncing. Syncing will always be a manual process since you will have to provide your Garmin one time code

Config changes:

1. If you use configuration.local.json then there is a new flag that needs to be set
2. If you use the WebUI, you can find the new flag under the Garmin section in Settings

Console/Command Line Experience:

1. When the TwoStep Verification setting is enable, P2G will
   1. Start the auth flow with Garmin
   2. You will receive an email or text from Garmin with your 2fa code
   3. You will be prompted by P2G to enter your code
2. Assuming auth is successful, P2G will continue as normal from here

WebUI Experience:

1. Whenever you click a "Sync" button, P2G will check if we need to go through the 2FA flow
2. If so, you will receive an email or text from Garmin with your 2fa code
3. P2G will prompt you with a modal to enter your 2fa code
4. Assuming auth is successful, P2G will continue as normal from here

How to get these changes:
Consider yourselves beta testers before I officially cut a new release of the code. With that in mind you can grab the version you need from the below sources:

1. Windows exe
2. Docker - Make sure you are pulling the console-latest/api-latest/webui-latest tag instead of stable or one of the release versions
3. Source - Make sure you've pulled down the latest from the master branch

[qpop01]

would there be any way to make this work via github actions? e.g. with a token or cookie with logged-in state? Github sites to produce a web interface for 2fa?

[philosowaffle]

Instead of investing time to find an even hackier way of using GitHub Actions / Sites, I would rather focus on solutions that will work without me having to write and support a whole bunch of new code and that will be more future-proof when changes like this happen.

A solution more along the lines of adding a one-click "Deploy to Heroku" or "Deploy to DigitalOcean" button (or whatever the popular hosting service is these days) would be ideal.

[qpop01]

Ah that makes sense. I'm mostly just sad about it because I'm going to have to work out how to have a hosted version elsewhere/turn it into a home-assistant "add-on" in docker.

[philosowaffle]

I assume by your comment that you are running HomeAssistant OS, which is a fantastic starting point, but it seems you're starting nudge up against the limitations of what it can do (i.e. having to jump through the hoops of "add-ons" just to run a new docker container).

You may find it beneficial to start poking at plain old Docker, it will open up a whole new world of possible software you can run without having to wait for HomeAssistant to have an add-on for it.

But I do hear your pain points, I'm hoping a one-click deploy button to a free tier on some 3rd party service will be accessible for most people and fill the gap of GitHub Actions for those that need to have Two-Factor enabled.

Note for others who find themselves on this thread: GHA will continue to work so long as Garmin Two-Factor auth is disabled.

[qpop01]

I suspect I'll get mandatory 2FA soon as I have a fenix 7 which I believe has the hardware for ECG...

It looks like building a homeassistant add-on is just a case of specifying the details of a docker container : https://developers.home-assistant.io/docs/add-ons/tutorial/

If I got some help putting one together by anyone in the community, I'd happily upload it to HACS and make it publicly available for other HA users...obviously a free tier script on heroku would be an amazing alternative.

I asked a question on a fresh thread and then answered it (turning a manual sync into an iOS shortcut) which I think is a really neat thing to do, and hope it can be replicated with other methods.