Widget+cffi fails with email MFA — unexpected title 'GARMIN Authentication Application'

[ajgbanach-ops]

Describe the bug
When running garmin-mcp-auth on an account with email-based MFA (mandatory for accounts with ECG-capable devices), authentication fails at the widget+cffi step with the following error:
widget+cffi failed: Widget login: unexpected title 'GARMIN Authentication Application'
✗ Authentication failed
Invalid email or password.
The "Invalid email or password" message is misleading — credentials are correct. The real issue is that the widget+cffi strategy doesn't handle the email MFA page.
Environment

Device: Garmin Venu 4 (ECG-capable → MFA mandatory, cannot be disabled)
MFA type: Email (one-time code sent to registered email)
OS: Windows 11
Command: uvx --python 3.12 --from git+https://github.com/Taxuspt/garmin_mcp garmin-mcp-auth

Full output
mobile+cffi returned 429: Mobile login returned 429 — IP rate limited by Garmin
mobile+requests returned 429: Mobile login returned 429 — IP rate limited by Garmin
widget+cffi failed: Widget login: unexpected title 'GARMIN Authentication Application'
✗ Authentication failed
Invalid email or password.
Root cause
The widget+cffi strategy (which correctly bypasses the per-account 429 rate limit) handles MFA when the page title is "Enter MFA code for login". However, email-based MFA renders a page with the title "GARMIN Authentication Application" instead. The strategy doesn't recognise this title and fails silently.
Background: the widget+cffi approach was introduced to bypass per-account 429 rate limiting (see cyberjunky/python-garminconnect#344), and works correctly for TOTP/authenticator MFA. Email MFA uses a different page title in Garmin's SSO flow.
Expected behavior
The tool should recognise the "GARMIN Authentication Application" page title as an email MFA prompt, display a message like "Check your email for a one-time code", wait for user input, and submit the code to complete authentication.
Possible fix
In the widget+cffi login handler, extend the MFA title check to also match "GARMIN Authentication Application" alongside the existing "Enter MFA code for login" check, then POST the entered code to /sso/verifyMFA/loginEnterMfaCode.
Additional context
Accounts linked to ECG-capable devices (Venu 4, Fenix 8, etc.) have MFA permanently enforced by Garmin and cannot disable it. This makes garmin-mcp-auth completely non-functional for a non-trivial subset of users. Fixing email MFA support in widget+cffi would unblock all of them.

[jedrazb]

Root cause is upstream in garminconnect: the widget SSO login only treats a page as MFA when the title contains "MFA", but email-based MFA returns the title GARMIN Authentication Application, so it never prompts for the code.

I opened a fix to upstream: cyberjunky/python-garminconnect#371. Once it's released, bumping the garminconnect pin here resolves this.

[Taxuspt]

The root cause is inside python-garminconnect: the widget+cffi login strategy only recognises an MFA page when the title contains "MFA", but email-based MFA renders a page titled "GARMIN Authentication Application" instead, so the library never prompts for the code and fails silently.

A fix has been opened upstream: cyberjunky/python-garminconnect#371. Once that PR is merged and a new version is released, the fix here will be a single-line version bump in pyproject.toml (garminconnect==0.3.2 → new version).

Nothing to patch on our side in the meantime — the workaround is to authenticate from a machine/network that is not IP rate-limited by Garmin (so the mobile+cffi or mobile+requests strategies succeed before reaching widget+cffi). We will bump the dependency as soon as the upstream fix is released.

Edit: I just saw @jedrazb comment above mine 🤐

[Taxuspt]

This is a real bug. Email MFA uses the page title 'GARMIN Authentication Application' while the widget+cffi handler only recognizes 'Enter MFA code for login' (TOTP/authenticator flow).

The fix requires extending the title check in the widget+cffi login path of the python-garminconnect library to also match the email MFA title — this is upstream of this project. The relevant upstream issue is cyberjunky/python-garminconnect#344.

Options while waiting for an upstream fix:

1. Use garmin-mcp-auth on a machine that isn't rate-limited — the mobile login strategy handles email MFA correctly; rate-limiting is per-IP so a different network (VPN, mobile hotspot, different machine) often works.

2. Use a token file from another client — if you've authenticated Garmin Connect on another app (Garmin Express, third-party Garmin apps), the saved token file can be copied to ~/.garminconnect.

3. Pre-generate a base64 token — if you can authenticate via the Garmin Connect web app + browser devtools, the session token can be exported and passed as GARMIN_TOKENS_BASE64.

We'll update this issue if/when the upstream library adds email MFA support for the widget+cffi strategy.