From cb5b766f83b6e495426554f087be70b67b25bf68 Mon Sep 17 00:00:00 2001 From: Gary Oberbrunner Date: Fri, 10 Jul 2026 10:30:46 -0400 Subject: [PATCH 1/2] Add chargepoint domain skill: Datadome blocks password login, use coulomb_sess cookie Co-Authored-By: Claude Fable 5 --- domain-skills/chargepoint/auth.md | 36 +++++++++++++++++++++++++++++++ 1 file changed, 36 insertions(+) create mode 100644 domain-skills/chargepoint/auth.md diff --git a/domain-skills/chargepoint/auth.md b/domain-skills/chargepoint/auth.md new file mode 100644 index 00000000..ef30a5dc --- /dev/null +++ b/domain-skills/chargepoint/auth.md @@ -0,0 +1,36 @@ +# ChargePoint — session auth (driver.chargepoint.com) + +## Datadome blocks programmatic password login + +ChargePoint fronts its login API with Datadome bot protection. Server-side +password logins (e.g. from the Home Assistant `chargepoint` custom integration, +or any script POSTing credentials) get blocked with a bot challenge even when +the credentials are correct. Don't retry the password path — use a session +token from a real browser instead. + +## The session token is the `coulomb_sess` cookie + +- Domain: `.chargepoint.com` (shared across driver.chargepoint.com and na.chargepoint.com) +- Name: `coulomb_sess` (~43-char opaque value) +- Present whenever the user is logged in at https://driver.chargepoint.com +- Related cookies you'll see alongside it: `auth-session`, `ci_ui_session`, + `datadome` — `coulomb_sess` is the one API clients (python-chargepoint, + ha-chargepoint) accept as a session token. + +Grab it from the user's logged-in browser without navigating anywhere: + +```python +cookies = cdp("Storage.getCookies")["cookies"] +tok = next(c["value"] for c in cookies + if c["name"] == "coulomb_sess" and "chargepoint" in c["domain"]) +``` + +If no `coulomb_sess` cookie exists, the user isn't logged in — stop and ask +them to log in at driver.chargepoint.com first (don't type credentials). + +## Trap + +The HA chargepoint integration's reauth dialog offers both a password field +and a token field. The password path fails through HA's server (Datadome +again); paste the `coulomb_sess` value into the token field instead — +succeeds immediately. From 240ec041e96e1c70f648c7490805c722dfa6489d Mon Sep 17 00:00:00 2001 From: Gary Oberbrunner Date: Fri, 10 Jul 2026 11:17:09 -0400 Subject: [PATCH 2/2] Address review: handle missing coulomb_sess gracefully, note auth-session SSO path Co-Authored-By: Claude Fable 5 --- domain-skills/chargepoint/auth.md | 17 +++++++++++------ 1 file changed, 11 insertions(+), 6 deletions(-) diff --git a/domain-skills/chargepoint/auth.md b/domain-skills/chargepoint/auth.md index ef30a5dc..7240ca2b 100644 --- a/domain-skills/chargepoint/auth.md +++ b/domain-skills/chargepoint/auth.md @@ -14,19 +14,24 @@ token from a real browser instead. - Name: `coulomb_sess` (~43-char opaque value) - Present whenever the user is logged in at https://driver.chargepoint.com - Related cookies you'll see alongside it: `auth-session`, `ci_ui_session`, - `datadome` — `coulomb_sess` is the one API clients (python-chargepoint, - ha-chargepoint) accept as a session token. + `datadome` — `coulomb_sess` is what API clients (python-chargepoint, + ha-chargepoint) use as the session token. The `auth-session` JWT is also a + valid login path: python-chargepoint's `login_with_sso_session(sso_jwt)` + exchanges it for a `coulomb_sess` token, useful for SSO accounts when + `coulomb_sess` is absent. Grab it from the user's logged-in browser without navigating anywhere: ```python cookies = cdp("Storage.getCookies")["cookies"] -tok = next(c["value"] for c in cookies - if c["name"] == "coulomb_sess" and "chargepoint" in c["domain"]) +tok = next((c["value"] for c in cookies + if c["name"] == "coulomb_sess" and "chargepoint" in c["domain"]), + None) ``` -If no `coulomb_sess` cookie exists, the user isn't logged in — stop and ask -them to log in at driver.chargepoint.com first (don't type credentials). +If `tok` is None, the user isn't logged in (though an SSO account may still +have an `auth-session` cookie to exchange, per above) — stop and ask them to +log in at driver.chargepoint.com first (don't type credentials). ## Trap