connectapi `/userprofile-service/socialProfile` returns 401 "Token is not active" since ~2026-06-01 (0.3.3 / master)

[draper-coding]

Reproducible auth break against connectapi.garmin.com starting around 2026-06-01. Was working through 2026-05-30 on the same code/account/runner.

garminconnect: 0.3.3 (PyPI) — also confirmed against current master (= v0.3.4 tag, d206167)
Symptom: GarminConnectAuthenticationError: Failed to retrieve social profile, caused by API Error 401 on /userprofile-service/socialProfile during login().

Triangulation

Custom probe — identical auth headers (from client.get_api_headers(), including the freshly-refreshed Bearer) sent via three HTTP backends:

Probe	Result
Unauth GET connect.garmin.com	200 from any IP (edge reachable, no cf-mitigated)
Stored-token resume + _refresh_session() against diauth.garmin.com	succeeds, returns fresh DI bearer
Authenticated GET /userprofile-service/socialProfile via curl_cffi (safari_ios)	401, www-authenticate: Bearer error="invalid_token", error_description="Token is not active"
Same call via curl_cffi (chrome120)	401, identical www-authenticate
Same call via plain requests	401, identical www-authenticate

Identical 401 + identical www-authenticate across all three transports rules out TLS fingerprint / Cloudflare interference. The DI tier issues the bearer; the API tier rejects it as not active.

What it isn't

• Not an IP block — reproduces from both a GitHub Actions runner (datacenter) and a residential IP.
• Not token-store corruption — a freshly-issued bearer via the full 5-strategy login path 401s the same way.
• Not TLS fingerprinting at the API tier — three transports with three different JA3/JA4 profiles all get the same answer.
• Not a token-rotation regression — _refresh_session() against diauth.garmin.com succeeds; the new bearer is the one that's rejected.

Best guess

Garmin tightened API-tier bearer validation (new audience requirement, different grant flow, PKCE, mandatory client claim, etc.) in a way the current native auth engine doesn't satisfy. The error_description="Token is not active" is the standard RFC 6750 challenge — points at a server-side policy change rather than a client-side bug.

Happy to provide additional probe output (full request headers, alternate endpoints, web/JWT_WEB cookie fallback behavior) if useful.

[draper-coding]

Follow-up probes after the initial report:

P5 — JWT_WEB cookie auth path attempt (force a fresh strategy login, clear di_token, retry /socialProfile via cookie):

• _mobile_login_cffi returns GarminConnectTooManyRequestsError: Mobile login returned 429 — IP rate limited by Garmin after a single round of diagnostic probes — account-wide, follows the user across IPs (datacenter + residential).
• _widget_web_login succeeds and mints a fresh di_token — but jwt_web=None and csrf_token=None afterward. The widget flow appears not to populate the cookie session in 0.3.3.

So: cookie-based auth can't be tested as an alternative without a path that produces JWT_WEB; the only path that does (_mobile_login_cffi per client.py L879) is currently 429'd. Probably worth checking whether Garmin recently changed the widget flow to stop setting the cookie, or whether the lib's widget post-auth dance just doesn't harvest it.

Net: nothing on the client side appears to be a viable workaround. The fix has to be at the bearer-issuance layer (likely a grant-flow or audience-claim change Garmin now requires).

[cyberjunky]

I cannot reproduce it in first tries (0.3.4)... will investigate further...

[draper-coding]

Update with what worked on this account:

Strategy	Forced via skip_strategies={ALL} - {one}	Result
mobile+cffi	(3 impersonations: safari_ios, safari, chrome120)	All return 429 — account-wide cooldown, can't get past it
mobile+requests	—	Not tested (mobile bucket 429'd)
widget+cffi	—	(already known broken per #369 diagnosis)
portal+cffi	safari impersonation, 14s anti-WAF delay	✓ Login succeeded. /userprofile-service/socialProfile returned 200, /userprofile-service/userprofile/user-settings returned 200. di_token set, jwt_web not set.
portal+requests	—	Not tested (portal+cffi worked, didn't need fallback)

So at least one non-widget path produces tokens connectapi accepts. The pipeline is back online by pinning to 6dfc315 and setting skip_strategies={"widget+cffi"} — full sync ran successfully both locally and on a GitHub Actions runner.

One footgun worth documenting for downstream users: in our wrapper code, we'd been unzipping cached tokens to ~/.garminconnect before calling client.login(tokenstore=garth_dir). After a resume-failure (the API-tier 401), our "fresh login" call was silently re-loading those same poisoned tokens from disk and short-circuiting the strategy chain — skip_strategies had no effect because the chain never ran. Fix is to shutil.rmtree(garth_dir) between the failed resume and the fresh-login call. Maybe worth a note in the README or a helper, since the load-from-disk-before-strategy-chain behavior is non-obvious.

Open question whether mobile+* tokens would also be accepted by your API tier — we can't test until the 429 clears. If you'd like, I can re-run with mobile-only forced once cooldown lifts.

[cyberjunky]

Can you test latest version?

[Slyke]

Getting this with latest version:

2026-06-10 00:55:26,510 - INFO - Trying to login to Garmin Connect using token data from '~/.garminconnect'...
2026-06-10 00:55:29,992 - WARNING - Session is expired or login information not present/incorrect. You'll need to log in again...login with your Garmin Connect credentials to generate them.
Enter Garminconnect Login e-mail: --SNIP--
Enter Garminconnect password (characters will be visible): --SNIP--
2026-06-10 00:55:45,054 - ERROR - Failed to retrieve social profile
Traceback (most recent call last):
  File "/app/.venv/lib/python3.13/site-packages/garminconnect/__init__.py", line 494, in login
    prof = self.client.connectapi("/userprofile-service/socialProfile")
  File "/app/.venv/lib/python3.13/site-packages/garminconnect/client.py", line 1091, in connectapi
    return self._run_request("GET", path, **kwargs).json()
           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/.venv/lib/python3.13/site-packages/garminconnect/client.py", line 1192, in _run_request
    raise GarminConnectConnectionError(error_msg)
garminconnect.exceptions.GarminConnectConnectionError: API Error 401 -

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/app/garmin_grafana/garmin_fetch.py", line 154, in garmin_login
    result1, result2 = garmin.login(token_store)
                       ~~~~~~~~~~~~^^^^^^^^^^^^^
  File "/app/.venv/lib/python3.13/site-packages/garminconnect/__init__.py", line 499, in login
    raise GarminConnectAuthenticationError(
        "Failed to retrieve social profile"
    ) from e
garminconnect.exceptions.GarminConnectAuthenticationError: Failed to retrieve social profile

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/app/.venv/lib/python3.13/site-packages/garminconnect/__init__.py", line 494, in login
    prof = self.client.connectapi("/userprofile-service/socialProfile")
  File "/app/.venv/lib/python3.13/site-packages/garminconnect/client.py", line 1091, in connectapi
    return self._run_request("GET", path, **kwargs).json()
           ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^
  File "/app/.venv/lib/python3.13/site-packages/garminconnect/client.py", line 1192, in _run_request
    raise GarminConnectConnectionError(error_msg)
garminconnect.exceptions.GarminConnectConnectionError: API Error 401 -

The above exception was the direct cause of the following exception:

Traceback (most recent call last):
  File "/app/garmin_grafana/garmin_fetch.py", line 169, in garmin_login
    result1, result2 = garmin.login(token_store)
                       ~~~~~~~~~~~~^^^^^^^^^^^^^
  File "/app/.venv/lib/python3.13/site-packages/garminconnect/__init__.py", line 499, in login
    raise GarminConnectAuthenticationError(
        "Failed to retrieve social profile"
    ) from e
garminconnect.exceptions.GarminConnectAuthenticationError: Failed to retrieve social profile

During handling of the above exception, another exception occurred:

Traceback (most recent call last):
  File "/app/garmin_grafana/garmin_fetch.py", line 1587, in <module>
    garmin_obj = garmin_login()
  File "/app/garmin_grafana/garmin_fetch.py", line 192, in garmin_login
    raise Exception("Garmin login failed after credential/MFA attempt")
Exception: Garmin login failed after credential/MFA attempt

[cyberjunky]

Can you test again with latest version 0.3.6?