PSA: Unauthorized API use can disable your FordPass account

[x19]

Just wanted to jump in and share for folks not in EA. I used Ford’s website chat to get my account unlocked, thought to do so they had to transfer me to a “FordPass Guide”. After I was connected with a guide they resolved the lockout in a couple of hours.

It turns out you can bypass Ford website chat though, and go straight to a “FordPass” guide via the help button in the app. This is the route I would suggest for any non-EA folks who need to have their account unlocked due to third-party app/API use.

Sponsored

 

[dsheib]

Just wanted to jump in and share for folks not in EA. I used Ford’s website chat to get my account unlocked, thought to do so they had to transfer me to a “FordPass Guide”. After I was connected with a guide they resolved the lockout in a couple of hours.

It turns out you can bypass Ford website chat though, and go straight to a “FordPass” guide via the help button in the app. This is the route I would suggest for any non-EA folks who need to have their account unlocked due to third-party app/API use.

I just bought a Samsung S22+ to replace my Pixel 5 and, after installing FordPass I got the dreaded error when trying to log in. I tried logging into my account on the Ford.com site and got the same error. What's weird is that I can still use FordPass on my old phone and on my Android tablet, I'm guessing that if I log out I won't be able to log back on. I subscribe to Tronity and use the Ford Status widget and they continue to work as well so Ford hasn't turned off access. I chatted with a FordPass guide this morning and she gave me a case number and said it might be 3-5 days for someone to get back to me, hopefully it will happen a lot sooner.

 

[mkhuffman]

I just bought a Samsung S22+ to replace my Pixel 5 and, after installing FordPass I got the dreaded error when trying to log in. I tried logging into my account on the Ford.com site and got the same error. What's weird is that I can still use FordPass on my old phone and on my Android tablet, I'm guessing that if I log out I won't be able to log back on. I subscribe to Tronity and use the Ford Status widget and they continue to work as well so Ford hasn't turned off access. I chatted with a FordPass guide this morning and she gave me a case number and said it might be 3-5 days for someone to get back to me, hopefully it will happen a lot sooner.

Your account is disabled. My Tronity and Android Widget apps were also working fine with my account disabled. Unfortunately they will not enable your account if you still have apps using your user account because it is a violation of your terms and conditions. I archived my MME in Tronity and they cancelled my account. Nils is working on a solution but I doubt we will be able to use Tronity again until 2023.

They told me if I didn't remove those unauthorized apps they might permanently remove my account.

 

[ocr_salty]

Looks like I too have been locked out of my ford.co.uk account, but just get the CSIAH0320E code and no further explanation. If it's the same issues that your guys have and it's an API think then I have a big problem. Octopus (my electricity supplier) here in the UK use the API data to control charging the car when it is most environmentally friendly and/or better for the grid, it's also cheaper at the times when they choose to charge the car - could be a big problem and a huge 'foot in mouth' for Ford as we go into a period where there may be blackouts and more control over EV charging may be needed.

 

[DevSecOps]

Their system and the way they do API lockouts is a complete pile of steaming hot dog crap. As I have said many times they ENCOURAGE us, as developers, to use the API and enhance their products through the integrations and apps we make.

They have NO posted rules or items that are prohibited. Even using tools that we routinely use as developers can lock us out. As a developer, with a developer account I was asked why I used developer tools for testing API calls to their APIs. I mean c'mon...

I will say however that they are aware of these issues and I know there's people at Ford looking into this on a larger scale. I don't have a time line nor an idea of what the outcome will be, but hopefully something will change for the better soon.

 

[Eric_C_Boston]

I found my EAP and main Owner Dashboard locked out a couple of days ago and sent an email to EAP. I got a generic email back that they were looking into the problem. Of course I found the reason by reading the forums.

I signed up with my electric utility months ago to get rebates on my home charging. I assume that is the third-party app that caused the lockout.

 

[dsheib]

I found my EAP and main Owner Dashboard locked out a couple of days ago and sent an email to EAP. I got a generic email back that they were looking into the problem. Of course I found the reason by reading the forums.

I signed up with my electric utility months ago to get rebates on my home charging. I assume that is the third-party app that caused the lockout.

I'm still waiting for them to unlock me, when I talked to a FordPass Guide I told him that National Grid uses the Ford API to run a charging discount program. He replied that violates my terms of service and that Ford didn't authorize the utility to tie into their vehicles. I find it impossible to believe that's true, not to mention the fact that just about every other manufacturer allows third-party apps to access their data. On top of that, most people have no idea why they can't access their account anymore, there's just an alert symbol and a bunch of characters displayed so you have no idea what's gone wrong. Nice going, Ford - another way to make owners hate you.

 

[RickMachE]

My utility works WITH Ford to control charging. Ford resets charging hours after the utility requests it.

Perhaps these other utilities need to also do it that way.

 

[Mach-Lee]

I'm still waiting for them to unlock me, when I talked to a FordPass Guide I told him that National Grid uses the Ford API to run a charging discount program. He replied that violates my terms of service and that Ford didn't authorize the utility to tie into their vehicles. I find it impossible to believe that's true, not to mention the fact that just about every other manufacturer allows third-party apps to access their data.

Ford has worked with National Grid on a controlled charging solution: https://www.ford.com/grid/nationalgrid

It's called Ford SmartGrid and it should be integrated through the FordPass app. If you are using a different app besides FordPass, then that is not authorized by Ford. Only the method in the link above is authorized.

Many utilities have made their own unauthorized apps to control charging using Smartcar as their API provider, which is a known offender. Ford will allow usage of vehicle data by 3rd parties in the future, but the method of accessing that data will change for data security reasons (they will use OAuth so credentials are handled securely). Right now all these apps require you to give out your FordPass username and password to Smartcar for data access, that's against the terms to give to a 3rd party.

 

[OWG]

I signed up with my electric utility months ago to get rebates on my home charging. I assume that is the third-party app that caused the lockout.

National Grid? I emailed the app developer from within the app and they disabled the data connection within hours. They were refreshing every five minutes - I could see where the refresh demand ended. It still took ford about four days to let me out me out of the sin bin.

 

[OWG]

Ford has worked with National Grid on a controlled charging solution: https://www.ford.com/grid/nationalgrid

It's called Ford SmartGrid and it should be integrated through the FordPass app. If you are using a different app besides FordPass, then that is not authorized by Ford. Only the method in the link above is authorized.

Yes, and the business model as implemented is quite different with the utility directly throttling charging to 50% charge during high demand periods under the FordConnect solution. The return to the customer for participation is $50 upfront and $20 each year the customer continues. The demand control is entirely in the hands of the utility.

The ChargeSmartMA business model relies on consumer self-interest to shift the charging demand window into 8 pm - 8 am weekdays and offers a 3 ¢ /kWh rebate October-May and 5 ¢/kWh June-Sept.

In my use case ChargeSmartMA generated $38.32 in rebates between May and October 22 when I had them disconnect. That is almost twice the benefit and extended across a 12 month window would likely have been four times the "annual participation" rebate.

On a return to individual consumer, I think that ChargeSmartMA is the better program. I can't justify the continual polling, that is just abusive. The car signals when charging begins and when it is disconnected and how many kWh's it processed - some logic applied to the data refresh demands is in order.

 

[Mach-Lee]

On a return to individual consumer, I think that ChargeSmartMA is the better program. I can't justify the continual polling, that is just abusive. The car signals when charging begins and when it is disconnected and how many kWh's it processed - some logic applied to the data refresh demands is in order.

Or they could just use the charging logs. Download them from Ford, ChargePoint, or JuiceBox at the end of the month. Polling not required.

 

[methorian]

National Grid? I emailed the app developer from within the app and they disabled the data connection within hours. They were refreshing every five minutes - I could see where the refresh demand ended. It still took ford about four days to let me out me out of the sin bin.

So FordPass HA integration is still okay to use? When I got locked I removed FordPass from HA since I wasn't immediately sure what caused the block.

 

[OWG]

So FordPass HA integration is still okay to use? When I got locked I removed FordPass from HA since I wasn't immediately sure what caused the block.

Well let's just say that I am not asking Ford that question. They homed in on the ChargeSmart and I did what they asked.

But that gave me a good view of what ChargeSmart was asking of the API and car.

The FordPass Integration only demands a refresh when the service fordpass.refresh_status is called by an automation. Otherwise it "seems" to just be reading the data.

Now that I have said that, watch me get busted.:}

 

[JonathanEzor]

I'm going on 8 days since I discovered and reported the lockout and got a case number from Ford. Expecting it was Tronity that was causing the problem, I disabled it, and only later got it confirmed from Ford that it was the issue. I'm *still* waiting for my account to be unlocked. Grrrrr..... {Jonathan}

Sponsored