MFA Requirement

[kmohammadi6]

Hello, I just wanted to begin by saying thank you for all the speedy work to get the package up to date with the new API, I really appreciate it!

Looking at the GitHub version of the package, it seems that MFA is now required in order to use the package. Like many others, I have a script that I run automatically for order placement, as such having to use MFA each time would be impractical. Given the API change, is MFA enrollment going to be a prerequisite going forward?

If it is required, would saving the RH object as an rds and loading the rds file each time work indefinitely as a work around?

For example,
RH <- RobinHood(username = "my_username", password = "my_password, mfa_code = "my_mfa_code")
save(RH, file = "RH_account.Rdata")

In other words, do you know if the MFA code needs to be the live MFA code from the authenticator app?

[JestonBlu]

Hi, thanks im glad you enjoy the package. I will work on reenabling the non MFA login. I wanted to get something working quickly and make sure there were no other breaks. I have addressed all of the known api issues so ill turn my attention to this one.

[JestonBlu]

After looking at my account settings, i dont see an option to disable MFA, only edit my existing MFA. Unless I am missing something obvious. Can you point me to it?

[kmohammadi6]

Looking at it I don't think you can. I have access to two accounts, one with MFA one without. In the MFA enabled one I don't see a way to turn it off...

I was able to test the solution I had above, saving the RH object after using the MFA Code once seems to work. But I'm not sure if that's a reliable solution going forward.

RH <- RobinHood(username = "my_username", password = "my_password, mfa_code = "my_mfa_code")
save(RH, file = "RH_account.Rdata")
rm("RH")
load("RH.Rdata")

[JestonBlu]

okay, they must be pushing that... so something that people might not know is that the access token you get lasts for quite a while. Ive added the expiration (which i think is in seconds) to the RH object. Ive used one token for multiple days so its not like you have to login every time you do an action.

Looking at the api im wondering if the command would basically be the same. Ill change the function to not fail if you dont supply a mfa token. Then maybe you can test it and see if that works?

[kmohammadi6]

That sounds good, so you're saying that the mfa_code argument would be NULL by default, which is how it was previously right?
Let me know when I should give it a try!

[altanalytics]

I have not signed up for MFA but I was using an older version of the package and it suddenly stopped working two weeks ago. I am happy to test as well, but something tells me that MFA might be required. I played with some of the source code and it was giving me 404 anytime I didn’t provide mfa

[JestonBlu]

im planning to push a new branch tonight attached to this issue that will prevent the function from failing if you dont provide an mfa code. Im not going to change any of the other structure yet so the API call will still try to push an MFA, it will just be null (or i can hardcode an arbitrary value). If someone can install the separate branch version and give me some feedback that would be appreciated.

I sent an email to RH customer service on downgrading from MFA, but i have not received a response. Im guessing they are really pushing towards this and are planning on making it mandatory at some point.

[kmohammadi6]

Sounds good!
Using the current git version (1.6.8), I tried supplying a random number (as a character) for the MFA code on a non-MFA enabled account and I get a Bad Request error. Supplying NULL results in an error from the api_login function. The body dataframe cannot be built in the api_login function.

This is what I tried on the non-MFA enabled account:
mfa_token <- paste0(sample(0:9, size = 6, replace = T), collapse = "")
RH <- RobinHood(username = "my_user_name", password = "my_password", mfa_code = mfa_token)
And it resulted in the HTTP 400 Error

[altanalytics]

I am happy to try it but not sure it will work. I passed ‘’ and random strings. 404 error for all of them. It wouldn’t let me pass a NULL value. If they require mfa there won’t be a way to fully automate. I wrote packages for etrade and TD. They both allow for refreshing tokens allowing you to go indefinitely. TD uses oauth 2. Maybe Robinhood can allow something similar?

[JestonBlu]

If someone could try this out I would appreciate it.

[altanalytics]

400 Bad request

I used this code:

RobinHood <- function(username, password, mfa_code = NULL) {
    
    # If MFA is null, set to 0 and remove later
    if (is.null(mfa_code) == TRUE) mfa_code <- "000000"
  RH <- RobinHood::api_login(username, password, mfa_code)
  accounts <- RobinHood::api_accounts(RH)
  url_account_id <- accounts$url
  RH <- c(RH, url = list(account_id = url_account_id))
  if (is.null(RH$api_response.access_token)) {
    cat("Login not successful, check username and password.")
  }
  class(RH) <- "RobinHood"
  return(RH)
}

And the response was this:

Error in RobinHood::api_login(username, password, mfa_code) : 
 Bad Request (HTTP 400). 

[kmohammadi6]

I got the same thing, pulled down the latest commit of the pkg using:
devtools::install_github("jestonblu/RobinHood@062641f36a779b40cea884c49fd8857613fe9811")
When I tried to run it on my non-MFA account I get a the same Bad Request HTTP 400 error.

Not sure how helpful this is, but I took a closer look inside the api_login function and noticed when you run this line:
dta <- dta %>% content(type = "json") %>% rawToChar() %>% jsonlite::fromJSON() %>% as.list()

The dta list has an element named "detail" which returns: "Request blocked, challenge type required."

I am able to run the api_login function from the inside and it returns a list, but when I try to run:
accounts <- RobinHood::api_accounts(RH) I get an Unauthorized (HTTP 401) error

Given that you're trying to pass an MFA code to an account that doesn't have MFA enabled the error makes sense, but at the same time it seems that Robinhood is making it impossible to use the API without a MFA enrollment. Did you ever hear back from RH support?