From 72858c64f9da5318db1be6023a4583e2717bf76f Mon Sep 17 00:00:00 2001
From: Khoa Vo <vndangkhoa@gmail.com>
Date: Thu, 1 Jan 2026 17:40:23 +0700
Subject: [PATCH] Fix: Aggressive YouTube auth bypass with web_creator client
 and yt-dlp nightly

---
 backend/api/routes.py    | 20 +++++++++++++-------
 backend/requirements.txt |  2 +-
 2 files changed, 14 insertions(+), 8 deletions(-)

diff --git a/backend/api/routes.py b/backend/api/routes.py
index e74fb1e..cd3074f 100644
--- a/backend/api/routes.py
+++ b/backend/api/routes.py
@@ -626,7 +626,7 @@ async def stream_audio(id: str):
     try:
         # Check Cache for stream URL
         # Check Cache for stream URL
-        cache_key = f"v9:stream:{id}" # v9 cache key - tv_embedded auth bypass
+        cache_key = f"v10:stream:{id}" # v10 - web_creator client bypass
         cached_data = cache.get(cache_key)
         
         stream_url = None
@@ -644,17 +644,23 @@ async def stream_audio(id: str):
             print(f"DEBUG: Fetching new stream URL for '{id}'")
             url = f"https://www.youtube.com/watch?v={id}" 
             ydl_opts = {
-                # Use tv_embedded client which often bypasses sign-in requirements
-                'format': 'bestaudio[ext=m4a]/bestaudio/best',
-                'quiet': True,
+                # Try multiple formats, prefer webm which often works better
+                'format': 'bestaudio[ext=webm]/bestaudio[ext=m4a]/bestaudio/best',
+                'quiet': False,  # Enable output for debugging
                 'noplaylist': True,
                 'nocheckcertificate': True,
                 'geo_bypass': True,
+                'geo_bypass_country': 'US',
                 'socket_timeout': 30,
-                'retries': 3,
+                'retries': 5,
                 'force_ipv4': True,
-                # tv_embedded is an embedded player client that usually doesn't require auth
-                'extractor_args': {'youtube': {'player_client': ['tv_embedded', 'mediaconnect']}},
+                # Try web_creator client which sometimes bypasses auth, fallback to ios/android
+                'extractor_args': {'youtube': {'player_client': ['web_creator', 'ios', 'android', 'web']}},
+                # Additional options to avoid bot detection
+                'http_headers': {
+                    'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36',
+                    'Accept-Language': 'en-US,en;q=0.9',
+                },
             }
             
             try:
diff --git a/backend/requirements.txt b/backend/requirements.txt
index 4fae85a..9f8a221 100644
--- a/backend/requirements.txt
+++ b/backend/requirements.txt
@@ -5,6 +5,6 @@ pydantic==2.10.4
 python-multipart==0.0.20
 APScheduler>=3.10
 requests==2.32.3
-yt-dlp==2024.12.23
+yt-dlp @ https://github.com/yt-dlp/yt-dlp/archive/master.zip
 ytmusicapi==1.9.1
 syncedlyrics