Using Jellyfin API to update metadata fails → SSO error despite having an API key

Support apps
,
1

What type of hardware are you using: Virtual machine
What YunoHost version are you running: 12.0.13
What app is this about: Jellyfin

Describe your issue

Hello !

I try to update the metadata of my movie collection using the API.
To do that, I use both the id from TheMovieDataBase and the internal Id of the film.

I can do that with the API like this :

curl 'https://chez.moi/jellyfin/Items/RemoteSearch/Movie' \
  -H 'accept: application/json' \
  -H 'accept-language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7' \
  -H 'authorization: MediaBrowser Client="Jellyfin Web", Device="Chrome", DeviceId="cestlidentifiantdemonmatos", Version="10.10.5", Token="cestmontoken"' \
  -H 'content-type: application/json' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: same-origin' \
  -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36' \
  --data-raw '{"SearchInfo":{"ProviderIds":{"Tmdb":"1937","TmdbCollection":""}},"ItemId":"06d1ba006fb7b83fc1fa3b3f10f4f9bf"}'

which works great :

[{"Name":"Bonjour Tristesse","ProviderIds":{"Tmdb":"1937","Imdb":"tt0051429"},"ProductionYear":1958,"PremiereDate":"1958-01-14T23:00:00.0000000Z","ImageUrl":"https://image.tmdb.org/t/p/original/2KFoUQ1JXrazABCVglJPGF6isIL.jpg","SearchProviderName":"TheMovieDb","Overview":"En vacances \u00E0 Saint-Tropez, un veuf d\u00E9s\u0153uvr\u00E9 collectionne les conqu\u00EAtes f\u00E9minines et n\u00E9glige l\u0027\u00E9ducation de sa fille.","Artists":[]}]

Now, I want to update the film’s metadata, like I would in the web interface like this :

curl 'https://chez.moi/jellyfin/Items/06d1ba006fb7b83fc1fa3b3f10f4f9bf/RemoteSearch' \
  -H 'accept: application/json' \
  -H 'accept-language: fr-FR,fr;q=0.9,en-US;q=0.8,en;q=0.7' \
  -H 'authorization: MediaBrowser Client="Jellyfin Web", Device="Chrome", DeviceId="cestlidentifiantdemonmatos", Version="10.10.5", Token="cestmontoken"' \
  -H 'content-type: application/json' \
  -H 'sec-fetch-dest: empty' \
  -H 'sec-fetch-mode: cors' \
  -H 'sec-fetch-site: same-origin' \
  -H 'user-agent: Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/134.0.0.0 Safari/537.36' \
  --data-raw '{"ProviderIds":{"Tmdb":"1937"}}'

But there, I’m stuck with SSOwat blocking :

* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* We are completely uploaded and fine
< HTTP/2 404 
< server: nginx
< date: Mon, 07 Apr 2025 15:59:32 GMT
< content-length: 0
< x-sso-wat: You've just been SSOed
< x-response-time-ms: 4.4139
< content-security-policy: upgrade-insecure-requests
< x-content-type-options: nosniff
< x-xss-protection: 1; mode=block
< x-download-options: noopen
< x-permitted-cross-domain-policies: none
< x-frame-options: SAMEORIGIN
< permissions-policy: interest-cohort=()
< strict-transport-security: max-age=63072000; includeSubDomains; preload
<

I’ve generated an API key from Jellyfin Web Interface that seems to work, but now I’m stuck :frowning:

I would really appreciate some insight on what I miss there !

Thank you very much.

Share relevant logs or error messages

* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* TLSv1.3 (IN), TLS handshake, Newsession Ticket (4):
* old SSL session ID is stale, removing
* We are completely uploaded and fine
< HTTP/2 404 
< server: nginx
< date: Mon, 07 Apr 2025 15:59:32 GMT
< content-length: 0
< x-sso-wat: You've just been SSOed
< x-response-time-ms: 4.4139
< content-security-policy: upgrade-insecure-requests
< x-content-type-options: nosniff
< x-xss-protection: 1; mode=block
< x-download-options: noopen
< x-permitted-cross-domain-policies: none
< x-frame-options: SAMEORIGIN
< permissions-policy: interest-cohort=()
< strict-transport-security: max-age=63072000; includeSubDomains; preload
<