auth.getMobileSession fails

a.ts

import fetch from 'node-fetch'
import crypto from 'crypto'
import {strictEqual, deepStrictEqual} from 'assert'

function md5(string: string) {
  return crypto.createHash('md5').update(string, 'utf8').digest("hex");
}

export async function main() {
  const url = new URL(`https://ws.audioscrobbler.com/2.0/`)

  const method = `auth.getMobileSession`
  const username = 'xxx@gmail.com'
  const password = 'xxx'
  const api_key = 'xxx'
  const api_secret = 'xxx'

  const api_sig = md5([
    'api_key', api_key,
    'method', method,
    'password', password,
    'username', username,
    api_secret,
  ].join(''))

  const payload = {
    method,
    username,
    password,
    api_key,
    api_sig,
    format: 'json',
  }
  const body = new URLSearchParams(payload).toString()

  const json = await fetch(url.href, {
    method: 'POST',
    headers: { 'content-type': 'application/x-www-form-urlencoded' },
    body,
  }).then(e => e.json())

  deepStrictEqual(json,
  {
    "message": "Authentication Failed - You do not have permissions to access the service",
    "error": 4
  })
}