Login fails with "Expecting value: line 1 column 1 (char 0)"

[KernSani]

Description of the bug
Login fails:
2026-03-16 10:41:56+0100 main DEBUG logging is set to debug
2026-03-16 10:41:56+0100 account INFO Found credentials file
2026-03-16 10:41:56+0100 account INFO Phone: +491**********, PIN: ****
2026-03-16 10:41:57+0100 account CRITICAL Expecting value: line 1 column 1 (char 0)

To Reproduce
pytr login

Expected behavior
Login works ;-)

Error log

Environment

• OS: Mac
• pytr version: 0.4.6

Additional context
It was working approx. a week ago without issues
I deleted credentials and cookie files but that didn't help either (login fails after entering the PIN)

[FocusMode-coder]

Hey! I may be able to help with this bug.

I build custom fixes for Python projects and automation systems.

If you'd like help resolving this issue quickly feel free to reach out.

Happy to take a look 👍

[JoeBue1]

I'm having the same issue on downloading new documents:

12:29:20 Found credentials file
12:29:20 Phone: +4917********, PIN: ****
12:29:21 Expecting value: line 1 column 1 (char 0)

MacOS 15.7.4
pytr==0.4.6
babel==2.18.0
certifi==2026.2.25
coloredlogs==15.0.1
ecdsa==0.19.1
packaging==26.0
pathvalidate==3.3.1
pygments==2.19.2
requests-futures==1.0.2
shtab==1.8.0
websockets==16.0
humanfriendly==10.0
six==1.17.0
requests==2.32.5
charset-normalizer==3.4.6
idna==3.11
urllib3==2.6.3

[RealCLanger]

Seems like this is a general issue with Trade Republic. I also can't log on to their web interface. Can you?

[KernSani]

yep, looks like it's a TradeRepublic Issue. Web Interface also doesn't work for me (This morning I had just checked the app). So I guess we just have to wait (and hope that TR isn't implemeneting any changes to the Web Login)

[JoeBue1]

I can't login either via web; and a second software reported issues with the connection.
So this issue can be closed?

[RealCLanger]

Looks like it works again. So I'm closing this.

[tobias-goertz]

This issue isn't resolved — TR has deployed AWS WAF Bot Control on all /api/v1/auth/* endpoints. The outage on March 16 was likely them rolling it out. The web interface works again because the browser executes the AWS WAF JavaScript SDK challenge, but pytr still gets 403.

Root cause: Requests without a valid aws-waf-token cookie are rejected by the AWS ELB with HTTP 403 (HTML body, hence the JSONDecodeError).

Proof:

import requests

waf_token = "<token from browser>"

# Without WAF token → 403 from awselb/2.0
r = requests.post("https://api.traderepublic.com/api/v1/auth/web/login",
    json={"phoneNumber": "+49...", "pin": "..."})
# r.status_code == 403, r.headers["server"] == "awselb/2.0"

# With WAF token → 200, login succeeds
r = requests.post("https://api.traderepublic.com/api/v1/auth/web/login",
    json={"phoneNumber": "+49...", "pin": "..."},
    cookies={"aws-waf-token": waf_token},
    headers={"x-aws-waf-token": "undefined",
             "Origin": "https://app.traderepublic.com",
             "User-Agent": "Mozilla/5.0 ..."})
# r.status_code == 200
# r.json() == {"processId": "...", "countdownInSeconds": 30, "2fa": "SMS"}

I verified the full flow (init → 2FA code → confirm) works with the WAF token.

What's needed: The token is generated client-side by AwsWafIntegration.getToken() which requires a JavaScript runtime. Non-auth endpoints (e.g. /api/v1/timeline) are not affected.

[kugel-]

I can confirm @tobias-goertz post. With the exported cookie from firefox that endpoint works (asks for 2FA code).

However, if I hack this into pytr, then I get the following backtrace after entering the 2FA code:

  File "/home/u1000/.local/bin/pytr", line 10, in <module>
    sys.exit(main())
             ~~~~^^
  File "/home/u1000/.local/share/uv/tools/pytr/lib/python3.14/site-packages/pytr/main.py", line 473, in main
    login(
    ~~~~~^
        phone_no=args.phone_no,
        ^^^^^^^^^^^^^^^^^^^^^^^
    ...<2 lines>...
        store_credentials=args.store_credentials,
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    ),
    ^
  File "/home/u1000/.local/share/uv/tools/pytr/lib/python3.14/site-packages/pytr/account.py", line 87, in login
    tr.complete_weblogin(code)
    ~~~~~~~~~~~~~~~~~~~~^^^^^^
  File "/home/u1000/.local/share/uv/tools/pytr/lib/python3.14/site-packages/pytr/api.py", line 231, in complete_weblogin
    r.raise_for_status()
    ~~~~~~~~~~~~~~~~~~^^
  File "/home/u1000/.local/share/uv/tools/pytr/lib/python3.14/site-packages/requests/models.py", line 1026, in raise_for_status
    raise HTTPError(http_error_msg, response=self)
requests.exceptions.HTTPError: 403 Client Error: Forbidden for url: https://api.traderepublic.com/api/v1/auth/web/login/18bc6bf4-6e95-XXXX-YYYY-665dba861b47/6793

[nvergnac-powens]

You can't use the web login anymore without the x-aws-waf-token

But it's a totally different issue than the initial one

[kugel-]

Well the error message (without the cookie) is the same

[MedAzizKhayati]

It seems like they started rolling out AWS Waf, the only way to fix this is to find a reliable way to bypass AWS WAF.

[RealCLanger]

I just did this: I opened a web session to TR, traced the login request through chrome developer tools, copied the "x-aws-waf-token" and injected it in pytr. With that, I could connect the web session again. However, this approach isn't "user-friendly", so we'd need a way to generate a waf token automatically in python. But is that possible?