allows logging in via auth tokens on play.qobuz.com

qbztoken.user.js

// ==UserScript==
// @name        qobuz auth token login
// @namespace   io.github.uhwot.qbztoken
// @match       https://play.qobuz.com/*
// @grant       none
// @version     1.0
// @author      uh wot
// @description allows logging in via auth tokens on qobuz
// @homepageURL https://gist.github.com/uhwot/8250904f3e4bfbad684c5ec26943e082
// @downloadURL https://gist.github.com/uhwot/8250904f3e4bfbad684c5ec26943e082/raw/qbztoken.user.js
// @icon        https://play.qobuz.com/resources/favicon/favicon-96x96.png
// @run-at      document-start
// ==/UserScript==

function waitForElm(selector) {
    return new Promise(resolve => {
        if (document.querySelector(selector)) {
            return resolve(document.querySelector(selector));
        }

        const observer = new MutationObserver(mutations => {
            if (document.querySelector(selector)) {
                resolve(document.querySelector(selector));
                observer.disconnect();
            }
        });

        observer.observe(document.body, {
            childList: true,
            subtree: true
        });
    });
}

function ass() {
    if (window.location.pathname === "/login") {
        waitForElm("div.LoginPage__content").then((_) => {
            const element = document.querySelector("div.LoginPage__content")

            const div = document.createElement("div")
            div.setAttribute("style", "width: 100%")

            const p = document.createElement("p")
            p.innerText = "Token:"
            p.setAttribute("style", "color: #FFFFFF")
            div.appendChild(p)

            const input = document.createElement("input")
            input.setAttribute("class", "SearchBar__input")
            input.setAttribute("type", "password")
            input.setAttribute("style", "padding: 0px 10px 0px 10px; width: 100%")

            input.addEventListener("keypress", function(event) {
                if (event.key === "Enter") {
                    event.preventDefault()
                    localStorage.setItem("shitass", input.value)
                    window.location = "https://play.qobuz.com/featured?code_autorisation=!shitass!"
                }
            })

            div.appendChild(input)

            element.appendChild(div)
        })
    }
}

const token = localStorage.getItem("shitass")
if (window.location == "https://play.qobuz.com/featured?code_autorisation=!shitass!" && token !== null) {
    localStorage.removeItem("shitass")

    window.fetch = (function (fetch) {
        return async function (url, init) {
            if (url.startsWith("https://www.qobuz.com/api.json/0.2/oauth/callback?code=!shitass!")) {
                window.fetch = fetch
                return new Response(JSON.stringify({
                    token: token,
                    user_id: "1"
                }))
            }

            return await fetch(url, init)
        }
    })(window.fetch);
}

window.addEventListener('load', function() {
    ass()

    const replaceState = window.history.replaceState
    Object.defineProperty(window.history, 'replaceState', {
        get(_) {return function() {
            replaceState.apply(window.history, arguments)
            ass()
        }},
        set(_) {},
    });

    const pushState = window.history.pushState
    Object.defineProperty(window.history, 'pushState', {
        get(_) {return function() {
            pushState.apply(window.history, arguments)
            ass()
        }},
        set(_) {},
    });
}, false)

Should this work with a vpn? Qobuz is not available in my country but I also can't log in with a vpn.

@fafner8 Qobuz blocks some VPN IPs, you're just gonna have to find one that works

Ok, thanks.

@uhwot This is no longer working (at least for me) when i try to log-in play.qobuz.com redirects me to qobuz.com/signin

@CrossyAtom46 it still works for me
there's a textbox under the "login" and "signup" buttons, you're supposed to paste the token there and press enter

@CrossyAtom46 it still works for me there's a textbox under the "login" and "signup" buttons, you're supposed to paste the token there and press enter

@uhwot I felt like I was blind, but the last time I used it, it wasn't like that. Thanks

@uhwot i think this time it's not working. because this time it redirects back to sign-in.

Tried with US vpn it is showing this.

@uhwot im not using VPN or anything gives me this

@uhwot im not using VPN or anything gives me this

Its happening probably because the token you're using was not generated for the current x-app-id header the new web version is using and this extension does not changes that header

I changed Token:'s color setting:
p.setAttribute("style", "color: #FFFFFF") to p.setAttribute("style", "color: #000000") for white page

Is there anyway we can use play.qobuz.com? Does someone find any fix?

Is there anyway we can use play.qobuz.com? Does someone find any fix?

My workaround for now is using burp or httptoolkit (requires pro version) to intercept the requests and change the x-app-id header to the version the token is for, the easiest way is to get a token that it works with the new header

Is there anyway we can use play.qobuz.com? Does someone find any fix?

My workaround for now is using burp or httptoolkit (requires pro version) to intercept the requests and change the x-app-id header to the version the token is for, the easiest way is to get a token that it works with the new header

I totally understand the concept behind it. Kind of a long stretch personally. But hope someone make an extension, like the above one. May be I'll get my hands on it soon. If you come across any simple solution. Please post it here. I totally loved playing songs in hi res using web player more than downloading them. Thanks for the reply bro :)))

Guys, i've added streamurl function to streamrip, and added listen feature to my MediaHarbor project. you guys may want to check it.
https://github.com/mediaharbor/mediaharbor

Based on @Aerglonus workaround and @legowtham wish for an extension/modification I took the freedom to do some mods on the original script:

// ==UserScript==
// @name        qobuz auth token login (modded)
// @namespace   io.github.uhwot.qbztoken
// @match       https://play.qobuz.com/*
// @grant       none
// @version     1.4
// @author      uh wot / modded by some1
// @description allows logging in via auth tokens on qobuz
// @homepageURL https://gist.github.com/uhwot/8250904f3e4bfbad684c5ec26943e082
// @downloadURL https://gist.github.com/uhwot/8250904f3e4bfbad684c5ec26943e082/raw/qbztoken.user.js
// @icon        https://play.qobuz.com/resources/favicon/favicon-96x96.png
// @run-at      document-start
// ==/UserScript==

// --- INPUT YOUR APP_ID HERE ---
const FORCED_APP_ID = "YOUR_X_APP_ID_HERE";
// ---------------------------------

function waitForElm(selector) {
    return new Promise(resolve => {
        if (document.querySelector(selector)) {
            return resolve(document.querySelector(selector));
        }
        const observer = new MutationObserver(mutations => {
            if (document.querySelector(selector)) {
                resolve(document.querySelector(selector));
                observer.disconnect();
            }
        });
        observer.observe(document.body, { childList: true, subtree: true });
    });
}

function ass() {
    if (window.location.pathname === "/login") {
        waitForElm("div.LoginPage__content").then((_) => {
            const element = document.querySelector("div.LoginPage__content")
            const div = document.createElement("div")
            div.setAttribute("style", "width: 100%")

            const p = document.createElement("p")
            p.innerText = "Token:"
            p.setAttribute("style", "color: #FFFFFF")
            div.appendChild(p)

            const input = document.createElement("input")
            input.setAttribute("class", "SearchBar__input")
            input.setAttribute("type", "password")
            input.setAttribute("style", "padding: 0px 10px 0px 10px; width: 100%")

            input.addEventListener("keypress", function(event) {
                if (event.key === "Enter") {
                    event.preventDefault()
                    localStorage.setItem("shitass", input.value)
                    window.location = "https://play.qobuz.com/featured?code_autorisation=!shitass!"
                }
            })

            div.appendChild(input)
            element.appendChild(div)
        })
    }
}

// Intercept focused on POST body
const token = localStorage.getItem("shitass")

window.fetch = (function (originalFetch) {
    return async function (url, init) {
        let urlStr = typeof url === 'string' ? url : (url instanceof Request ? url.url : '');

        // 1. Local intercept (avoids CORS)
        if (urlStr.includes("oauth/callback") && urlStr.includes("code=!shitass!")) {
            localStorage.removeItem("shitass");
            return new Response(JSON.stringify({
                token: token,
                user_id: "1"
            }), {
                status: 200,
                headers: { 'Content-Type': 'application/json' }
            });
        }

        // 2. Modifies Body in POST requests for the API
        if (urlStr.includes("qobuz.com/api.json") && init && init.method && init.method.toUpperCase() === "POST") {
            if (init.body) {
                try {
                    // Case A: The body is a JSON String
                    if (typeof init.body === 'string' && init.body.trim().startsWith('{')) {
                        let jsonBody = JSON.parse(init.body);
                        jsonBody["app_id"] = FORCED_APP_ID;
                        init.body = JSON.stringify(jsonBody);
                    }
                    // Case B: Body is a URL Encoded string (ex: param1=val1&app_id=old)
                    else if (typeof init.body === 'string') {
                        let params = new URLSearchParams(init.body);
                        params.set("app_id", FORCED_APP_ID);
                        init.body = params.toString();
                    }
                    // Case C: Body uses native object URLSearchParams directly
                    else if (init.body instanceof URLSearchParams) {
                        init.body.set("app_id", FORCED_APP_ID);
                    }
                    // Case D: Body uses FormData
                    else if (init.body instanceof FormData) {
                        init.body.set("app_id", FORCED_APP_ID);
                    }
                } catch (e) {
                    console.error("Erro ao injetar app_id no corpo do POST:", e);
                }
            } else {
                // If POST came without body for some reason, we create one containing the app_id
                init.body = JSON.stringify({ "app_id": FORCED_APP_ID });
            }
        }

        return await originalFetch(url, init);
    }
})(window.fetch);

window.addEventListener('load', function() {
    ass()

    const replaceState = window.history.replaceState
    Object.defineProperty(window.history, 'replaceState', {
        get(_) {return function() {
            replaceState.apply(window.history, arguments)
            ass()
        }},
        set(_) {},
    });

    const pushState = window.history.pushState
    Object.defineProperty(window.history, 'pushState', {
        get(_) {return function() {
            pushState.apply(window.history, arguments)
            ass()
        }},
        set(_) {},
    });
}, false)

@11ph22il I tried it, but it didn't work for me!

@11ph22il I tried it, but it didn't work for me!

Try installing an extension to block CORS, like this: https://chromewebstore.google.com/detail/anti-cors-anti-csp/fcbmpcbjjphnaohicmhefjihollidgkp

Check if your token uses the new appid too

Here I also disabled uBlock Origin on play.qobuz.com

I'll try to fix the CORS issue soon.

Well, I tried everything you said, but it didn't work for me =(
I disabled uBlock, installed the CORS add-on, but I still can't log in.

this is what happens:

https://play.qobuz.com/login
https://play.qobuz.com/featured?code_autorisation=!shitass!
and back to https://play.qobuz.com/login

{
"status": "error",
"message": "User authentication is required.. (Root=1-6a1d3afb-7e47e0463943442b6d409526)",
"code": 401
}

Im also replaced this part YOUR_X_APP_ID_HERE with using the current app_id, and happens the same thing. And I realize that in the headers the app-id is different, it starts with 7... not 3.

But well, I'll try with another browser later.

@11ph22il im using microsoft edge and your modded version works fine for me, thanks!

@11ph22il it works, thanks! (thorium browser v150 beta)

Does not work for me. I tried Firefox and Opera, with and without the CORS addons

I have forked the code and provided an update here which works for me and one other (according to the comments). Can anyone else test it and let me know/provide feedback?