[How To] Request a X-Plex-Token token for your app

jmper · September 15, 2015, 7:09am

Hello

Could some one help me with authorization?
I trying using next code but it always get me empty result with error 400
what I’m doing wrong?

$url = “https://plex.tv/users/sign_in.json”;

$base64 = base64encode(“user:password”);

$header = array();
$header = “Authorization: Basic $base64”;
$header = “X-Plex-Client-Identifier: 1234-5678-9012-345”;
$header = “X-Plex-Product: my_apps”;
$header = “X-Plex-Version: my_app_v1”;

$ch = curl_init();
curl_setopt($ch, CURLOPT_URL,$url);
curl_setopt($ch, CURLOPT_HTTPHEADER,$header);
curl_setopt($ch, CURLOPT_TIMEOUT, 30);
curl_setopt($ch, CURLOPT_POST, 1);
curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, false);
curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, false);
curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
$json = curl_exec($ch);
curl_close($ch);

Arcanemagus · September 15, 2015, 4:01pm

@jmper You might want to use cURL’s built in functionality for generating the Authorization header.

Here is how PlexWatch/Web does it:

curl_setopt($process, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
if (defined('CURLOPT_USERNAME') && defined('CURLOPT_PASSWORD')) {
	// only defined for some versions of php-curl
	curl_setopt($process, CURLOPT_USERNAME, $user);
	curl_setopt($process, CURLOPT_PASSWORD, $pass);
} else {
	curl_setopt($process, CURLOPT_USERPWD, $user . ':' . $pass);
}

Note that issues can arise if the username contains a ‘:’ if you are forced to use the older method. (I think that was the reported issue at least)

jmper · September 15, 2015, 6:37pm

@Arcanemagus Thank you!
I found PlexWatch/Web code, and now it’s works!

  $host = "https://plex.tv/users/sign_in.json";
  $username = 'myPlexUser';
  $password = 'myPlexPass';
  $header = array(
               'Content-Type: application/xml; charset=utf-8', 
               'Content-Length: 0', 
               'X-Plex-Client-Identifier: 8334-8A72-4C28-FDAF-29AB-479E-4069-C3A3',
               'X-Plex-Product: Test',
               'X-Plex-Version: v1_06',
               );
  $process = curl_init($host);
  curl_setopt($process, CURLOPT_HTTPHEADER, $header);
  curl_setopt($process, CURLOPT_HEADER, 0);
  curl_setopt($process, CURLOPT_HTTPAUTH, CURLAUTH_BASIC);
  curl_setopt($process, CURLOPT_USERPWD, $username . ":" . $password);
  curl_setopt($process, CURLOPT_TIMEOUT, 30);
  curl_setopt($process, CURLOPT_SSL_VERIFYPEER, 0);
  curl_setopt($process, CURLOPT_POST, 1);
  curl_setopt($process, CURLOPT_RETURNTRANSFER, true);
  $data = curl_exec($process);
  $curlError = curl_error($process);
  $json = json_decode($data, true);

cybera · October 19, 2015, 12:26am

Here is a sample using C# (.net 4.5)

`
/* using c# */

    public void GetTokenSample()
    {
        var plainTextBytes = System.Text.Encoding.UTF8.GetBytes("username:password");
        string auth = System.Convert.ToBase64String(plainTextBytes);

        using (var client = new WebClient())
        {
            var values = new NameValueCollection();
            values["Authorization"] = "Basic " + auth;
            values["X-Plex-Client-Identifier"] = "myAppID"; 
            values["X-Plex-Product"] = "my App Name";
            values["X-Plex-Version"] = "0.1.0";

            client.Headers.Add(values);

            var response = client.UploadString("https://plex.tv/users/sign_in.json", "");

            var json = new JavaScriptSerializer();
            dynamic result = json.DeserializeObject(response);
            
            var token = result["user"]["authentication_token"];

            Console.WriteLine(token);
        }
    }

`

chowmain_software · January 3, 2016, 5:17pm

@L0ck for Plex said:

@sander1 said:
The correct URL is https://plex.tv/pms/servers.xml, with /pms/ in the middle of the URL.

A related query is there a known method to authorize the new user pin feature, will be easy to get the pin from the uer but how and which url will validate the pin, I did a search in the forum but cannot seem to find any api.

Found this Plex Fluid userscript · GitHub but am stull unsure.

/iSh0w

Get all users under an owner’s account - HTTP GET https://plex.tv/api/home/users (note need the owners token)
Get the user’s token - HTTP POST “https://plex.tv/api/home/users/” + id + “/switch” (note need to pass in the user id in the url and post the password in the body
This will return a token.

Thats as far as i got. I tried to utilise the returned user token rather than the owner’s token and i get 401’s from here on out. So not sure what i’m doing wrong.

croneter · January 13, 2016, 6:18am

@chowmain_software said:

@L0ck for Plex said:

@sander1 said:
The correct URL is https://plex.tv/pms/servers.xml, with /pms/ in the middle of the URL.

A related query is there a known method to authorize the new user pin feature, will be easy to get the pin from the uer but how and which url will validate the pin, I did a search in the forum but cannot seem to find any api.

Found this Plex Fluid userscript · GitHub but am stull unsure.

/iSh0w

Get all users under an owner’s account - HTTP GET https://plex.tv/api/home/users (note need the owners token)

Get the user’s token - HTTP POST “https://plex.tv/api/home/users/” + id + “/switch” (note need to pass in the user id in the url and post the password in the body

This will return a token.

Thats as far as i got. I tried to utilise the returned user token rather than the owner’s token and i get 401’s from here on out. So not sure what i’m doing wrong.

Same problem here. Even most basic requests to PMS fail with this user token. Been trying with Fiddler as well, cloning Plex Web requests with a replaced token.

Anyone got any idea?

chowmain_software · January 14, 2016, 2:52am

@croneter said:

@chowmain_software said:

@L0ck for Plex said:

@sander1 said:
The correct URL is https://plex.tv/pms/servers.xml, with /pms/ in the middle of the URL.

A related query is there a known method to authorize the new user pin feature, will be easy to get the pin from the uer but how and which url will validate the pin, I did a search in the forum but cannot seem to find any api.

Found this Plex Fluid userscript · GitHub but am stull unsure.

/iSh0w

Get all users under an owner’s account - HTTP GET https://plex.tv/api/home/users (note need the owners token)

Get the user’s token - HTTP POST “https://plex.tv/api/home/users/” + id + “/switch” (note need to pass in the user id in the url and post the password in the body

This will return a token.

Thats as far as i got. I tried to utilise the returned user token rather than the owner’s token and i get 401’s from here on out. So not sure what i’m doing wrong.

Same problem here. Even most basic requests to PMS fail with this user token. Been trying with Fiddler as well, cloning Plex Web requests with a replaced token.

Anyone got any idea?

I figured it out.

You need to get a server access token from plex.tv using the user token. The server access token should be used to authetnicate against the server.

So the steps are

using the user token get https://plex.tv/pms/servers.xml

match Server Identifier against the server you are looking at connecting to.

note down the accessToken for that server. Thats what you need.

croneter · January 14, 2016, 6:14am

@chowmain_software said:

@croneter said:

@chowmain_software said:

@L0ck for Plex said:

@sander1 said:
The correct URL is https://plex.tv/pms/servers.xml, with /pms/ in the middle of the URL.

A related query is there a known method to authorize the new user pin feature, will be easy to get the pin from the uer but how and which url will validate the pin, I did a search in the forum but cannot seem to find any api.

Found this Plex Fluid userscript · GitHub but am stull unsure.

/iSh0w

Get all users under an owner’s account - HTTP GET https://plex.tv/api/home/users (note need the owners token)

Get the user’s token - HTTP POST “https://plex.tv/api/home/users/” + id + “/switch” (note need to pass in the user id in the url and post the password in the body

This will return a token.

Thats as far as i got. I tried to utilise the returned user token rather than the owner’s token and i get 401’s from here on out. So not sure what i’m doing wrong.

Same problem here. Even most basic requests to PMS fail with this user token. Been trying with Fiddler as well, cloning Plex Web requests with a replaced token.

Anyone got any idea?

I figured it out.

You need to get a server access token from plex.tv using the user token. The server access token should be used to authetnicate against the server.

So the steps are

using the user token get https://plex.tv/pms/servers.xml

match Server Identifier against the server you are looking at connecting to.

note down the accessToken for that server. Thats what you need.

Very cool, that’s going to safe me some time!

vincen · June 2, 2016, 6:16am

@sander1 said:
Do a HTTP POST request to https://plex.tv/users/sign_in.json (or https://plex.tv/users/sign_in.xml) with:

user[login] and user[password] form values in the body. For example: user%5Blogin%5D=plexusername&user%5Bpassword%5D=myplexpassword

HTTP header: X-Plex-Client-Identifier: a unique value for your client

HTTP header: X-Plex-Product: the name of your client

HTTP header: X-Plex-Version: the version of your client

Trying to do it first by hand in a telnet to figure out exact syntax for my automation system but confused here by exact syntax for post !
Should I do it this way ?
POST /users/sign_in.xml user_login=myuser&user_password=mypassword&X-Plex-Client-Identifier=myidentifier&X-Plex-Product=myproduct&X-Plex-Version=myversion
Each time I type my post request and then enter I get disconnected from server before I can type next line !

Thanks

Arcanemagus · June 2, 2016, 4:46pm

@vincen If I were you I would just use the command line curl interface to properly send the headers, however if you must use telnet, it looks like you need to type the headers before the body, each on its own line.

vincen · June 2, 2016, 5:20pm

@Arcanemagus said:
@vincen If I were you I would just use the command line curl interface to properly send the headers, however if you must use telnet, it looks like you need to type the headers before the body, each on its own line.

curl would be definitively easier but I do it on a proprietary system where I have no access at such tools. Thanks for link explaining how to do it, unhappy I discovered the crap automation system I use is still unable to do HTTPS connections so no way to do a plex client in it

WurtzelSepp_1 · October 20, 2016, 7:17pm

has someone an examplecode for javascript ?

T4ng · November 4, 2016, 11:50pm

@WurtzelSepp, JavaScript sample:

function getToken() {
    const username = 'username';
    const password = 'password';

    const url = 'https://plex.tv/users/sign_in.json';
    const request = new XMLHttpRequest();

    request.open('POST', url, true);
    request.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    request.setRequestHeader('X-Plex-Client-Identifier', '4444-f-444');
    request.setRequestHeader('X-Plex-Product', 'TestClient');
    request.setRequestHeader('X-Plex-Version', '0.1');
    request.onreadystatechange = () => {
        if(request.readyState === 4 && request.status === 201) {
            const data = JSON.parse(request.responseText);
            const authToken = data.user.authToken;
            console.log('authToken:', authToken);
        }
    };

    request.send('user[login]=' + username + '&user[password]='+ password);
}

robert.j.erickson · December 20, 2016, 6:26am

I needed to get the plex token using python3. I have a sample script below (based off of script from user svdlugt) that stores and prints the auth. token.

#!/usr/bin/env python
# -*- coding: utf-8 -*-
import http.client, urllib.request, urllib.parse, urllib.error, base64

ip_add = '192.168.XXX.XXX' # change this to the local IP address of the plex server
username = "UsernameHere" # change this to your plex login username
password = "PasswordHere" # change this to the corresponding password for your username
base64string = base64.encodestring(('%s:%s' % (username, password)).encode()).decode().replace('

', ‘’)
txdata = “”

headers={'Authorization': "Basic %s" % base64string,
                'X-Plex-Client-Identifier': "Test script",
                'X-Plex-Product': "Test script 356546545",
                'X-Plex-Version': "0.001"}

conn = http.client.HTTPSConnection("plex.tv")
conn.request("POST","/users/sign_in.json",txdata,headers)
response = conn.getresponse()
#print(response.status, response.reason) # user svdlugt had this, but I didn't know what it was for and didn't need it
data = response.read()
data_str = str(data)
print(data_str) # I removed this in my script, because I didn't need the additional information that it provides
token_str_plus = data_str.split('_token":"')[1]
token_str =  token_str_plus.split('"')[0] # this is the token string. It can be used later in the script or passed to another script
print(token_str)
conn.close()

honkdazzle · February 10, 2017, 12:31am

Doesn’t this create a ton of untrusted apps that are now asking users to enter their plaintext Plex credentials? Already there are things like Plex Requests, PlexPy, etc. that rely on this technique and are now conditioning Plex users to willingly input their plaintext username/password into forms that Plex cannot control.

I realize that many Plex users are fully local only, but if you are a server admin you are not about to type in your username/password into someone else’s Plex Requests/Ombi portal for example. Even people who are not server admins should not be haphazardly sharing their account credentials with random software they clone off github.

Ideally, Plex should host a proper SSO login page (on https://plex.tv, with CSRF prevention) that handles a login and generates a role-specific auth token for it. Even more ideally, all the apps should have their own API key and tokens should only be valid for those apps, but that’s harder.

midwire · March 3, 2017, 6:35pm

Here is an example using curl from the command line:

curl -X "POST" "https://plex.tv/users/sign_in.json" \
     -H "X-Plex-Version: 1.0.0" \
     -H "X-Plex-Product: YOUR PRODUCT NAME" \
     -H "X-Plex-Client-Identifier: YOUR-PRODUCT-ID" \
     -H "Content-Type: application/x-www-form-urlencoded; charset=utf-8" \
     --data-urlencode "user[password]=YOUR_PASSWORD" \
     --data-urlencode "user[login]=YOUR_USERNAME"

“YOUR PRODUCT NAME” and “YOUR-PRODUCT-ID” can be anything you’d like.

darkunderlord · March 28, 2017, 2:20pm

@honkdazzle said:
Doesn’t this create a ton of untrusted apps that are now asking users to enter their plaintext Plex credentials? Already there are things like Plex Requests, PlexPy, etc. that rely on this technique and are now conditioning Plex users to willingly input their plaintext username/password into forms that Plex cannot control.

I realize that many Plex users are fully local only, but if you are a server admin you are not about to type in your username/password into someone else’s Plex Requests/Ombi portal for example. Even people who are not server admins should not be haphazardly sharing their account credentials with random software they clone off github.

Ideally, Plex should host a proper SSO login page (on https://plex.tv, with CSRF prevention) that handles a login and generates a role-specific auth token for it. Even more ideally, all the apps should have their own API key and tokens should only be valid for those apps, but that’s harder.

I agree. Can’t we get an answer on this? And how do we get the user’s info for every client they want to use my channel with? We can’t even use a text box, etc to get the info. Does every user have to have the ability to edit the script, etc to get their token for their specific user account and specific client? I am making a channel that will rip with MakeMKV to a local repository, and don’t really need anything but local access.

noshali · April 1, 2017, 6:55am

Hi
Need yur help…I am new to all this…and not a programmer at all. I am using an app called postman and need to know the exact steps to get the token. What headers I need. what do i need to type for the body etc. where to get unique identifier etc. It has a username password form so that can be filled. Please help as need token for my home assistant. Would really appreciate it.
Thanks

scarfdestroyer · April 28, 2017, 1:59am

I was have some trouble with Auth in Ruby(Rails) but I finally figured it out. I thought that the body would be something like this:

body: { user: { login: username, password: password }}.to_json

but using an example in another language from above(Thanks @T4ng ), I was like “this doesnt make any sense to format it like this but yolo”

body: "user[login]=#{username}&user[password]=#{password}"

aaaaand it worked…

Anyone know why you cant use key and value pairs for the body/auth part? Is there a way i can structure the key/values to where Plex’s API will pick it up? I have my headers structured like the first example and they are all picked up fine in my “Devices” tab in my web app.

sander1 · April 28, 2017, 11:43pm

@scarfdestroyer said:
Anyone know why you cant use key and value pairs for the body/auth part?

The format is specified by the content type, and the default content type (which is also used by Plex) is application/x-www-form-urlencoded. This requires the request body to be formatted just like a query string:

parameter=value&another_parameter=another_value

Topic		Replies	Views
JWT Authentication Dev/API Corner other-dev , pms-api	29	790	December 11, 2025
Authenticating with Plex Dev/API Corner other-third-party , other-dev	1	56860	July 1, 2020
myPlex access with HTTP API Dev/API Corner other-dev	10	994	December 20, 2019
Pulling my hair out - Can't get anything API like working Dev/API Corner other-dev	11	241	January 8, 2020
How to get a transient token from the server Dev/API Corner other-dev	15	1041	January 8, 2020

[How To] Request a X-Plex-Token token for your app

Related topics