SIMKL authorize callback does not happen

[wilhelmstroker]

I've just started over with Crosswatch, and am having an issue where I'm unable to add SIMKL as an authentication provider.
Crosswatch 0.6.4. When I add my Client ID and Client Secret and click on Connect SIMKL, nothing happens and obviously SIMKL is not getting added.
Things I've tried:

1. Deleted and recreated the docker container
2. Tried different browsers (Edge, Firefox, Chrome. Firefox and Chrome are clean installs without any addins)
3. Rebooted the host machine (Synology NAS)
4. Restarted Crosswatch from the UI
5. Enabled logging, in the docker logs I see this entry, but it doesn't really correspond to the time I clicked on connect....
   [2026-01-16 17:04:32] [AUTH] INFO SIMKL: start OAuth
6. Grabbed a HAR browser trace but that doesn't show any calls to simkl.com.

Any thoughts? This was working on my previous install so I'm at a loss. Surely I missed something obvious....

[cenodude]

Could be a couple of things:

1.Is the correct redirect URI configured in SIMKL in your SIMKL Apps (where the client and secret ID are stored?)

2. are you sure you have the correct client ID and secret and you are not on your daily limit or is banned?

3. After you enter your client ID/secret in CrossWatch and click Connect, it should open a new browser tab to SIMKL where you must click Yes/Allow. If that tab doesn’t open or the prompt is blocked, your browser is probably rejecting it, add CrossWatch to your allowlist or/and disable the blocker for it.

Normal flow would be: ....and i just tested it with 0.6.4:
[AUTH] INFO SIMKL: start OAuth
[AUTH] INFO SIMKL: exchange code <-- new SIMKL tab/browser
[AUTH] SUCCESS SIMKL: tokens stored <-- key is sucessfuly received from SIMKL

[cenodude]

Oh and check if your container has internet access.

[wilhelmstroker]

1.Is the correct redirect URI configured in SIMKL in your SIMKL Apps (where the client and secret ID are stored?)
Yep this is correct, I'm using the same settings as my previous config but also tried with a a new app in Simkl.

2. are you sure you have the correct client ID and secret and you are not on your daily limit or is banned?
   Definitely the right settings and as far as I can tell no daily limits have been hit.

3. After you enter your client ID/secret in CrossWatch and click Connect, it should open a new browser tab to SIMKL where you must click Yes/Allow. If that tab doesn’t open or the prompt is blocked, your browser is probably rejecting it, add CrossWatch to your allowlist or/and disable the blocker for it.
   The new browser tab never opens and no adblocker is configured for the CrossWatch page as the addin is disabled and even testing with brand new installs of browsers it never opens.

The container definitely has Internet access as the same config worked fine before I decided to blow away the config and other containers can access the ihternet fine.

[cenodude]

Strange one, mostly because I can’t reproduce it on my end. Are you running CrossWatch behind a reverse proxy (Nginx, Traefik, Caddy, Cloudflare, etc.) or anything else in front of it?

and what do you get when you do: http://yourhost-or-IP/callback

[wilhelmstroker]

No reverse proxy involved here, I go straight to the ip address internally.
Going to callback gives me Missing code or state.
I also tried setting up trakt and that correctly opens the browser window to authenticate.

[cenodude]

thats the correct respons. I've found another user that has the same issue as you.. so i need to dive into it a little bit more..

[rendez2k]

I have the same issue, my instance is via ElfHosted. A new browser tab never opens. Call back URL looks correct and I've set up two different API keys in Simkl to test.

[wilhelmstroker]

Trakt worked for me first time. I'll leave the tab open for a bit and see what happens then. Definitely a weird one!

[wilhelmstroker]

Bloody hell, yep, waited a little bit and the pop up blocker from chrome popped up and I'm able to sign into Simkl. Great find @rendez2k !

[rendez2k]

I felt there was almost a delay from plugging in the details and hiring save. I didn't realise I was waiting for a popup either.

[rendez2k]

Excellent! Definitely an accidently find!

[cenodude]

good good.. i will try to find some allternative solutions for this issue in a future release. Trakt opens the popup before any await. SIMKL opens it after await. so thats the main difference between these two..

[cenodude]

For both of you: it’s a smart idea to add intranet sites like CrossWatch to your pop-up allowlist.

chrome://settings/content/popups

[Entixs]

One thing I have noticed if you are running locally it will be fine but if you are running on a dedicated server it will take a bit of time. I do run mine through cloudflare DNS proxy which seemed to help. It's not as quick as it use to be. Not a big deal for me at least.

[cenodude]

what do you mean, the time before there will be a new window to connect with simkl you mean? if so, how many seconds approx?

[Entixs]

Nono. More so after you accept the callback it takes like 5 to 20 seconds for the API key to pop up. I noticed when I didn't run the dedicated server with cloudflare DNS the callback wouldn't pop up at all and would take me to the main screen of simkl... I will have to run that test again to make sure it is still a thing.

[cenodude]

Interesting. Not sure if this is a specific SIMKL issue with there callback or not.. Do you have the same delay with Trakt?

[cenodude]

think I’ve found the issue. During SIMKL auth, while we’re waiting for the authorize window to be confirmed, CrossWatch polls with an increasing backoff (up to 20s). That’s why you’re seeing the 5-20 second gaps. It’s basically there to avoid hammering the API with a burst of requests.

I’ve updated both the SIMKL and Trakt auth files on main, and I’ll publish a new 0.7.4 image soon.