Couldn't send message: Couldn't get access token: failed to decode response: invalid character '<' looking for beginning of value

[NatsuNiNi]

Starting the bot, I get this message as an answer to my hello msg

"Couldn't send message: Couldn't get access token: failed to decode response: invalid character '<' looking for beginning of value"

I searched for those issues before sending. But no help :(

Hope somebody can give me some help.

[wsimon98]

Same issue. Following to see if it gets fixed.

[Yousjjw]

when I try to install chatgpt-telegram ， I received the same error .

[wsimon98]

it has to do with how ChatGPT fixed authentication. You have to authenticate through the API code. And If i read this code right, it's using a login and cookie to do the authenticating.

[Yousjjw]

Looking forward to some updates

[AleksandrPe]

Can someone tell me how to fix it?

[NatsuNiNi]

Nah, till now I cant solve it :(

[jocull]

Something with the authentication has changed I believe. Here is the relevant code:

chatgpt-discord/src/chatgpt/chatgpt.go

Lines 66 to 69 in 3da7c72

	accessToken, err := c.refreshAccessToken()
	if err != nil {
	return nil, errors.New(fmt.Sprintf("Couldn't get access token: %v", err))
	}

which calls

chatgpt-discord/src/chatgpt/chatgpt.go

Lines 120 to 123 in 3da7c72

	req, err := http.NewRequest("GET", "https://chat.openai.com/api/auth/session", nil)
	if err != nil {
	return "", fmt.Errorf("failed to create request: %v", err)
	}

When you make a request following this it seems to spit back some HTML, which explains the invalid <.

If I copy the complete cookie set out of my browser then I can make this request work as expected, but it seems like the __Secure-next-auth.session-token value is not enough on its own. Here's the complete cookie set the website currently manages:

If I had to guess, the CSRF token is relevant somehow. It could also be that I did my authentication step on one machine (desktop) but then moved the token to a separate machine (server).

Hope those details help someone 🙂

[jocull]

On further inspection in a fresh browser session, I think this is a duplicate of #2