fix(examples): use /api/v2/user/login instead of authenticate()

Cloudflare added a managed challenge on /api/auth/v1/session (the
endpoint bitgo.authenticate() posts to), which breaks headless script
logins. Replace it with a direct call to the unchallenged
/api/v2/user/login endpoint followed by
bitgo.authenticateWithAccessToken(), handling both the direct
access_token response and the legacy ECDH-encrypted token response via
bitgo.handleTokenIssuance().

WCN-1331

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

Author: mohammadalfaiyazbitgo

examples/ts/btc/v1/wallet-passphrase-recovery.ts

@@ -8,9 +8,9 @@
  * - Environment (test/prod)
  * - Activation code
  * - Encrypted wallet passphrase from Box D of keycard
- * 
+ *
  * You need to install node and BitGoJS SDK to run this script.
- * 
+ *
  * To install node, you can follow the instructions here: https://nodejs.org/en/download
  *
  * To install BitGoJS SDK, you can use the following command:
@@ -56,6 +56,42 @@ async function main(): Promise<void> {
       env: env,
     });
 
+    // Get login credentials from stdin
+    const username = await askQuestion('\nEnter your BitGo username: ');
+    const password = await askQuestion('Enter your BitGo password: ');
+    const loginOtp = await askQuestion('Enter your OTP code for login: ');
+
+    console.log('\nAuthenticating with BitGo (via /api/v2/user/login)...');
+
+    // Authenticate with BitGo via /api/v2/user/login (avoids Cloudflare challenge on /api/auth/v1/session)
+    const loginResponse = await bitgo
+      .post(bitgo.url('/user/login', 2))
+      .send({ email: username, password, otp: loginOtp })
+      .result();
+
+    let accessToken: string;
+    if (loginResponse.access_token) {
+      accessToken = loginResponse.access_token;
+    } else if (loginResponse.encryptedToken) {
+      // Legacy accounts return an ECDH-encrypted token instead of a plain access_token
+      const { token } = await bitgo.handleTokenIssuance(loginResponse, password);
+      accessToken = token;
+    } else {
+      throw new Error('Login did not return a usable token (no access_token or encryptedToken).');
+    }
+
+    bitgo.authenticateWithAccessToken({ accessToken });
+
+    console.log('Authentication successful.');
+
+    // Get a fresh OTP for session unlock
+    const unlockOtp = await askQuestion('\nEnter a new OTP code for session unlock: ');
+
+    // Unlock session
+    console.log('Unlocking session...');
+    await bitgo.unlock({ otp: unlockOtp });
+    console.log('Session unlocked successfully.');
+
     // Get activation code
     const activationCode = await askQuestion('Enter activation code: ');
 

examples/ts/btc/v1/wallet-recovery-validation.ts

@@ -63,14 +63,26 @@ async function main(): Promise<void> {
     const password = await askQuestion('Enter your BitGo password: ');
     const loginOtp = await askQuestion('Enter your OTP code for login: ');
 
-    console.log('\nAuthenticating with BitGo...');
+    console.log('\nAuthenticating with BitGo (via /api/v2/user/login)...');
+
+    // Authenticate with BitGo via /api/v2/user/login (avoids Cloudflare challenge on /api/auth/v1/session)
+    const loginResponse = await bitgo
+      .post(bitgo.url('/user/login', 2))
+      .send({ email: username, password, otp: loginOtp })
+      .result();
+
+    let accessToken: string;
+    if (loginResponse.access_token) {
+      accessToken = loginResponse.access_token;
+    } else if (loginResponse.encryptedToken) {
+      // Legacy accounts return an ECDH-encrypted token instead of a plain access_token
+      const { token } = await bitgo.handleTokenIssuance(loginResponse, password);
+      accessToken = token;
+    } else {
+      throw new Error('Login did not return a usable token (no access_token or encryptedToken).');
+    }
 
-    // Authenticate with BitGo
-    await bitgo.authenticate({
-      username,
-      password,
-      otp: loginOtp,
-    });
+    bitgo.authenticateWithAccessToken({ accessToken });
 
     console.log('Authentication successful.');
 
@@ -127,7 +139,7 @@ Recovery information received:
     console.log('\nDecrypting wallet password using recovery information...');
 
     // Decrypt the original password
-    const decryptedPassword = bitgo.decrypt({
+    const decryptedPassword = await bitgo.decrypt({
       password: passcodeEncryptionCode,
       input: encryptedPrv,
     });