Login returns 401 Unauthorized - access-token header appears to be expired/rotated

[poiuy547379]

Problem

POST /sess/login returns 401 even with correct credentials (web login at firstrade.com works fine).

Debug Output

POST https://api3x.firstrade.com/sess/login
<<< Status: 401
<<< JSON body:
{
"statusCode": 401,
"error": "Unauthorized",
"message": "Authentication failed"
}
Request headers sent:
access-token: 833w3XuIFycv18ybi
Content-Type: application/x-www-form-urlencoded

Steps to reproduce

1. Install latest version from GitHub (pip install git+https://github.com/MaxxRK/firstrade-api.git)
2. Call FTSession(username=..., password=..., mfa_secret=..., debug=True).login()
3. Always returns 401

What I verified

• ✅ Credentials are correct (manual login at firstrade.com succeeds)
• ✅ TOTP secret is correct (code matches Google Authenticator)
• ✅ No PIN required on this account
• ✅ Tested with US VPN — still 401 (not a geo-block issue)
• ✅ Tested with both PyPI 0.0.38 and latest GitHub version

Hypothesis

The access-token: 833w3XuIFycv18ybi hardcoded in urls.py may have been rotated by Firstrade. The server rejects it with 401 before even validating the username/password.
Could you check if this token needs to be updated? Thank you!

[MaxxRK]

I am looking into this now.

In my initial testing from my PC this token still worked for me. I will do some more investigating on the app soon.

[Amodio]

It still works well for me aswell: no change regarding the Access token.

This is typical of wrong credentials: the problem is that you gave wrong 2FA secret key or wrong login/pw.
Regenerate that secret and it should work.

Note: they call it a set up key on their documentation: https://help.firstrade.info/en/articles/9260184-two-factor-authentication-2fa

@MaxxRK: adding an error message with this URL and differentiating cases would help.

Wrong login/pw:

send: b'POST /sess/login HTTP/1.1\r\nUser-Agent: okhttp/4.9.2\r\nAccept-Encoding: gzip\r\nAccept: */*\r\nConnection: Keep-Alive\r\nHost: api3x.firstrade.com\r\naccess-token: 833w3XuIFycv18ybi\r\nCookie: TS01740dd1=01d7aa468c66c0db889f06d55069f42236e0a339be3cbc3f5f27c7fb6220c3cd55444de791157f573dd8cac16de4d639ce5b6b70bd\r\nContent-Length: 21\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\n'
send: b'username=X&password=Y'
reply: 'HTTP/1.1 401 Unauthorized\r\n'
header: Content-Type: application/json; charset=utf-8
header: Transfer-Encoding: chunked
header: Connection: keep-alive
header: Date: Sat, 30 May 2026 01:11:31 GMT
header: X-FT-IP-Country: FR
header: vary: origin,accept-encoding
header: cache-control: no-cache
header: content-encoding: gzip
header: X-Cache: Error from cloudfront
header: Via: 1.1 fa1d164da2e001fd457ab863d748d2b0.cloudfront.net (CloudFront)
header: X-Amz-Cf-Pop: CDG55-P1
header: X-Amz-Cf-Id: B_92iCIXw-0_nZ0000LCE7KcH52OP761-jF8U9_JLjRJ1g8PM-ueRQ==
DEBUG:firstrade.account:>>> POST https://api3x.firstrade.com/sess/login
DEBUG:firstrade.account:<<< Status: 401
DEBUG:firstrade.account:<<< Headers: {'Content-Type': 'application/json; charset=utf-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Date': 'Sat, 30 May 2026 01:11:31 GMT', 'X-FT-IP-Country': 'FR', 'vary': 'origin,accept-encoding', 'cache-control': 'no-cache', 'content-encoding': 'gzip', 'X-Cache': 'Error from cloudfront', 'Via': '1.1 fa1d164da2e001fd457ab863d748d2b0.cloudfront.net (CloudFront)', 'X-Amz-Cf-Pop': 'CDG55-P1', 'X-Amz-Cf-Id': 'B_92iCIXw-0_nZ0000LCE7KcH52OP761-jF8U9_JLjRJ1g8PM-ueRQ=='}
DEBUG:firstrade.account:<<< Raw bytes length: 75
DEBUG:firstrade.account:<<< JSON body:
{
  "statusCode": 401,
  "error": "Unauthorized",
  "message": "Authentication failed"
}
Traceback (most recent call last):
  File "/home/firstrade-api/./test.py", line 14, in <module>
    need_code = ft_ss.login()
  File "/home/firstrade-api/firstrade/account.py", line 151, in login
    raise LoginRequestError(response.status_code)
firstrade.exceptions.LoginRequestError: Error in HTTP request during login. HTTP status code: 401

Wrong 2FA secret:

send: b'POST /sess/verify_pin HTTP/1.1\r\nUser-Agent: okhttp/4.9.2\r\nAccept-Encoding: gzip\r\nAccept: */*\r\nConnection: Keep-Alive\r\nHost: api3x.firstrade.com\r\naccess-token: 833w3XuIFycv18ybi\r\nCookie: ...\r\nContent-Length: 71\r\nContent-Type: application/x-www-form-urlencoded\r\n\r\n'
send: b'mfaCode=42&remember_for=30&t_token=42'
reply: 'HTTP/1.1 401 Unauthorized\r\n'
header: Content-Type: application/json; charset=utf-8
header: Transfer-Encoding: chunked
header: Connection: keep-alive
header: Date: Sat, 30 May 2026 01:13:10 GMT
header: X-FT-IP-Country: FR
header: vary: origin,accept-encoding
header: cache-control: no-cache
header: content-encoding: gzip
header: X-Cache: Error from cloudfront
header: Via: 1.1 e13b2607dfc4aed7d33bb2308acad23e.cloudfront.net (CloudFront)
header: X-Amz-Cf-Pop: CDG55-P1
header: X-Amz-Cf-Id: AM7cNYtSD0tbsaa6sGE3pSdDBx1a-q-2uRq0gOxKMonCO6xDopth0Q==
DEBUG:firstrade.account:>>> POST https://api3x.firstrade.com/sess/verify_pin
DEBUG:firstrade.account:<<< Status: 401
DEBUG:firstrade.account:<<< Headers: {'Content-Type': 'application/json; charset=utf-8', 'Transfer-Encoding': 'chunked', 'Connection': 'keep-alive', 'Date': 'Sat, 30 May 2026 01:13:10 GMT', 'X-FT-IP-Country': 'FR', 'vary': 'origin,accept-encoding', 'cache-control': 'no-cache', 'content-encoding': 'gzip', 'X-Cache': 'Error from cloudfront', 'Via': '1.1 e13b2607dfc4aed7d33bb2308acad23e.cloudfront.net (CloudFront)', 'X-Amz-Cf-Pop': 'CDG55-P1', 'X-Amz-Cf-Id': 'AM7cNYtSD0tbsaa6sGE3pSdDBx1a-q-2uRq0gOxKMonCO6xDopth0Q=='}
DEBUG:firstrade.account:<<< Raw bytes length: 75
DEBUG:firstrade.account:<<< JSON body:
{
  "statusCode": 401,
  "error": "Unauthorized",
  "message": "Authentication failed"
}
Traceback (most recent call last):
  File "/home/firstrade-api/./test.py", line 13, in <module>
    need_code = ft_ss.login()
  File "/home/firstrade-api/firstrade/account.py", line 154, in login
    need_code: bool | None = self._handle_mfa()
                             ~~~~~~~~~~~~~~~~^^
  File "/home/firstrade-api/firstrade/account.py", line 299, in _handle_mfa
    raise LoginResponseError(self.login_json["error"])
firstrade.exceptions.LoginResponseError: Failed to login. API returned the following error: Unauthorized