# PHP API v 2.0 Issue

**URL:** <https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73>\
**Category:** Friendly Help\
**Created:** [October 27, 2017, 10:09pm UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73 "2017-10-27T22:09:41Z")\
**Posts on this page:** 13\
**Page:** 1

<div class="post-metadata">

**Author:** ![Something](https://avatars.discourse-cdn.com/v4/letter/s/a8b319/32.png) [@Something](https://www.patreondevelopers.com/u/Something)\
**Post date:** [October 27, 2017, 10:09pm UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73/1 "2017-10-27T22:09:41Z")

</div>

Hey,

I’ve been using [PHP](https://github.com/Patreon/patreon-php) to interact with the Patreon API for a while now, however my scripts appear to have stopped working as of yesterday(-ish).

Upon investigating, I noticed that a newer version of the project had been committed (going from version 1.0 to 2.0). However updating didn’t solve the issue.

I dug into it a bit and I’ve noticed that I’m no longer getting a token reply. I investigated into the curl calls being executed by OAuth.php, and the response consists of an HTML block which says:

_"One more step_

_Please complete the security check to access [api.patreon.com](http://api.patreon.com)"_

I’m not sure what to make of it, since I’d expect the API to return some sort of json block if there was a problem.

Could this be a hiccup with the updated API itself or am I simply missing something? I’m still learning my way through here, so it might just be me. The relevant section of code after returning from the Patreon Login page with the appropriate single-use code is effectively the same as the example on the documentation:

```
$client_id = 'x';
$client_secret = 'y';
$creator_id = 'z';
$redirect_uri = "a;
   //(All substituted by their appropriate values, of course)

$oauth_client = new Patreon\OAuth($client_id, $client_secret);

$tokens = $oauth_client->get_tokens($_GET['code'], $redirect_uri);
$access_token = $tokens['access_token']; 
$refresh_token = $tokens['refresh_token'];

```

Both tokens return NULL, and following the get\_tokens() function leads to the aforementioned HTML.

Any ideas?  
Thanks.

---

<div class="post-metadata">

**Author:** ![tal](https://yyz2.discourse-cdn.com/flex036/user_avatar/www.patreondevelopers.com/tal/32/4_2.png) [@tal](https://www.patreondevelopers.com/u/tal)\
**Post date:** [October 28, 2017, 12:39am UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73/2 "2017-10-28T00:39:55Z")

</div>

Here, and just read this. Let me check with the person who would be most knowledgeable on our team, and get their attention on this.

Great writeup. Thank you.

---

<div class="post-metadata">

**Author:** ![Something](https://avatars.discourse-cdn.com/v4/letter/s/a8b319/32.png) [@Something](https://www.patreondevelopers.com/u/Something)\
**Post date:** [October 29, 2017, 1:37pm UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73/3 "2017-10-29T13:37:36Z")

</div>

Hey just following up, it seems the tokens are back now; thank you!

---

<div class="post-metadata">

**Author:** ![tal](https://yyz2.discourse-cdn.com/flex036/user_avatar/www.patreondevelopers.com/tal/32/4_2.png) [@tal](https://www.patreondevelopers.com/u/tal)\
**Post date:** [October 30, 2017, 3:01pm UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73/4 "2017-10-30T15:01:17Z")

</div>

Thanks for following up on this. I’m going to try to figure out what happened here :-/

---

<div class="post-metadata">

**Author:** ![LiraNuna](https://yyz2.discourse-cdn.com/flex036/user_avatar/www.patreondevelopers.com/liranuna/32/9_2.png) [@LiraNuna](https://www.patreondevelopers.com/u/LiraNuna)\
**Post date:** [October 31, 2017, 2:27am UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73/5 "2017-10-31T02:27:18Z")

</div>

Hi there!

This is most likely an issue with cloudflare’s bot detection. If you’re able to give us more information we should be able to work to make sure it won’t happen again.

We don’t have those kind of restrictions and I’m very certain “Please complete the security check to access” comes from Cloudflare.

Any additional information you have will help us make this issue a thing of the past both for you and other API consumers.

---

<div class="post-metadata">

**Author:** ![codebard](https://yyz2.discourse-cdn.com/flex036/user_avatar/www.patreondevelopers.com/codebard/32/14_2.png) [@codebard](https://www.patreondevelopers.com/u/codebard)\
**Post date:** [October 31, 2017, 8:08pm UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73/6 "2017-10-31T20:08:20Z")

</div>

Yeah that indeed seems to be cloudflare.

In similar cases one can also easily suspect any server-level interference from things like mod\_security filtering and modifying urls, redirects, post & get operation. I encountered such a situation with a user who had his WP website at Bluehost. They seem to have a rather over-configured mod\_security that filters many things. Even the oauth redirect that comes back to WP after authorization at patreon.

---

<div class="post-metadata">

**Author:** ![Something](https://avatars.discourse-cdn.com/v4/letter/s/a8b319/32.png) [@Something](https://www.patreondevelopers.com/u/Something)\
**Post date:** [November 6, 2017, 10:43pm UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73/7 "2017-11-06T22:43:35Z")

</div>

Hey guys, sorry to bring this up again but I’ve got more info:

-The problem came back last night, same issue.  
-My host is [Hostgator](https://www.hostgator.com/about). I contacted their support team to look into the mod\_security points from above, but the technician didn’t find any violations coming from my site in their security logs.

Is there any other information I could provide that would help? I checked the curl\_exec($ch) response in OAuth.php and I’m pretty sure that the text is the [generic Cloudfare protection text](https://imgur.com/avcwSBG) as Lira suggested; that “Please enable cookies” that’s included with it seems kind of suspect though. Could that be related? Possibly some setting I need to flip on my end?

---

<div class="post-metadata">

**Author:** ![LiraNuna](https://yyz2.discourse-cdn.com/flex036/user_avatar/www.patreondevelopers.com/liranuna/32/9_2.png) [@LiraNuna](https://www.patreondevelopers.com/u/LiraNuna)\
**Post date:** [November 7, 2017, 7:42pm UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73/8 "2017-11-07T19:42:38Z")

</div>

Instead of using `api.patreon.com`, can you try using `www.patreon.com/api` instead?

---

<div class="post-metadata">

**Author:** ![Something](https://avatars.discourse-cdn.com/v4/letter/s/a8b319/32.png) [@Something](https://www.patreondevelopers.com/u/Something)\
**Post date:** [November 7, 2017, 9:17pm UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73/9 "2017-11-07T21:17:34Z")

</div>

Tested; it gave me the same result unfortunately.

---

<div class="post-metadata">

**Author:** ![glaap](https://yyz2.discourse-cdn.com/flex036/user_avatar/www.patreondevelopers.com/glaap/32/52_2.png) [@glaap](https://www.patreondevelopers.com/u/glaap)\
**Post date:** [November 8, 2017, 6:38pm UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73/10 "2017-11-08T18:38:30Z")

</div>

I’m having the same problem with PHP API v1.0

---

<div class="post-metadata">

**Author:** ![tgg](https://avatars.discourse-cdn.com/v4/letter/t/34f0e0/32.png) [@tgg](https://www.patreondevelopers.com/u/tgg)\
**Post date:** [April 25, 2018, 11:05am UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73/11 "2018-04-25T11:05:01Z")

</div>

Bumping this as I have the issue too. Your API is using cloudflare protection which is actually returning a captcha instead of JSON data (which breaks all your parsing code) I really don’t understand why you’re using a captcha on an API instead of some other method of rate control. As I assume my servers IP is somehow blacklisted by cloudflare, how am I supposed to access the API? (Which was working fine until 2 weeks ago)

---

<div class="post-metadata">

**Author:** ![Bloodysunset](https://avatars.discourse-cdn.com/v4/letter/b/a5b964/32.png) [@Bloodysunset](https://www.patreondevelopers.com/u/Bloodysunset)\
**Post date:** [May 4, 2018, 9:59am UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73/12 "2018-05-04T09:59:59Z")

</div>

Hello there!

I’m seeing the same things on my end (about the captcha, when the curl\_exec occurs)… Would be great to have an update from the Patreon devs or if someone find a trick…

Have a nice day.

---

<div class="post-metadata">

**Author:** ![LiraNuna](https://yyz2.discourse-cdn.com/flex036/user_avatar/www.patreondevelopers.com/liranuna/32/9_2.png) [@LiraNuna](https://www.patreondevelopers.com/u/LiraNuna)\
**Post date:** [May 4, 2018, 11:12pm UTC](https://www.patreondevelopers.com/t/php-api-v-2-0-issue/73/13 "2018-05-04T23:12:59Z")

</div>

Hi there! We are aware of this issue and actively trying to figure out how to solve this issue.
