login() fails with 404 — https://api.spond.com/core/v1/login no longer responding

[mattaubrey]

Login is returning a 404 from the API endpoint, making the library completely unusable.

Environment
spond version: 1.2.0
Python version: 3.12
OS: Ubuntu 24.04

Steps to reproduce
Any call that requires authentication, e.g.:

python
import asyncio
from spond import spond

async def main():
    s = spond.Spond(username="user@example.com", password="password")
    groups = await s.get_groups()
    await s.clientsession.close()

asyncio.run(main())

Error

aiohttp.client_exceptions.ContentTypeError: 404, message='Attempt to decode JSON 
with unexpected mimetype: ', url='https://api.spond.com/core/v1/login'

Investigation
Confirmed via curl that the endpoint returns a 404:

bash
curl -s -X POST https://api.spond.com/core/v1/login \
  -H "Content-Type: application/json" \
  -d '{"email":"test@test.com","password":"test"}'

Response: {"message":"HTTP 404 Not Found","errorCode":404}
Also tested core/v2/login — same result. Looks like Spond may have changed their login endpoint.
Has anyone found a working URL? I can login on app and web.

[lancasterJ]

I also have this issue. The problem started on 13 May 2026 between 8:37 and 8:53 GMT.

[TSFoster]

Logging in to the website submits a POST request to https://api.spond.com/core/v1/auth2/login now (I think it used to be https://api.spond.com/core/v1/login).

Body of the request:

{
  "email": "EMAIL_ADDRESS",
  "password": "RAW_PASSWORD"
}

Response:

{
  "accessToken": {
    "token": "TOKEN",
    "expiration": "2026-05-14T12:00:00Z"
  },
  "refreshToken": {
    "token": "TOKEN",
    "expiration": "2026-08-11T12:00:00Z"
  },
  "passwordToken": {
    "token": "TOKEN",
    "expiration": "2026-05-13T13:00:00Z"
  }
}

[TSFoster]

I believe the accessToken can be used as a drop-in replacement for the previous endpoint's loginToken object

[mattaubrey]

that's working as a fix, thanks

[Starefossen]

Confirmed fix — monkey-patch for _SpondBase.login:

As @TSFoster noted, the endpoint moved to /core/v1/auth2/login and the token is now nested under accessToken. Here's a minimal patch that works as a drop-in:

from spond.base import _SpondBase
from spond import AuthenticationError

async def _patched_login(self) -> None:
    login_url = f"{self.api_url}auth2/login"
    data = {"email": self.username, "password": self.password}
    async with self.clientsession.post(login_url, json=data) as r:
        login_result = await r.json()
        access = login_result.get("accessToken")
        if access and isinstance(access, dict):
            self.token = access.get("token")
        if self.token is None:
            err_msg = f"Login failed. Response received: {login_result}"
            raise AuthenticationError(err_msg)

_SpondBase.login = _patched_login

Apply before instantiating Spond(...). Tested and working — all existing API calls (get_groups, get_events, etc.) continue to work since the Bearer token format is unchanged.

The response also includes refreshToken and passwordToken objects which could be useful for longer-lived sessions, but for the library's current pattern of logging in fresh each session, just extracting accessToken.token is sufficient.

[Olen]

Fixed in v1.2.1, just published to PyPI: https://pypi.org/project/spond/1.2.1/

Upgrade with:

pip install --upgrade spond

The login endpoint now points at /core/v1/auth2/login and reads the bearer token from the new nested accessToken.token field. Public API is unchanged — self.token, auth_headers, and login()'s signature all behave as before, so no consumer code needs to change.

Thanks @lancasterJ for the original report, @TSFoster for tracing the new endpoint shape, and @mattaubrey @Starefossen for confirming the fix. PR: #230. Release: https://github.com/Olen/Spond/releases/tag/v1.2.1