FordPass Token Grabber

A minimal Chrome (Manifest V3) extension that captures the fordapp://userauthorized/?code=... OAuth redirect produced by Ford's (Azure AD B2C) login flow — on any login.ford.* or login.lincoln.* domain — and shows the full URL in a copyable balloon.

It exists to make setting up the Home Assistant FordPass integration easier: after logging in you normally have to dig the redirect URL out of DevTools by hand. This extension surfaces it for you.

Why an extension and not a userscript?

Ford completes login with an HTTP 302 redirect whose Location header points at a custom scheme (fordapp://...). A Tampermonkey/userscript runs in the page context, where the browser resolves that redirect before any page JavaScript can read the Location header — and it refuses to navigate to the custom scheme anyway. So a userscript can never reliably see the token.

A real extension can use the webRequest API, which reads response headers at the network layer (the same place the DevTools Network tab reads them). The onBeforeRedirect event fires with the exact fordapp://.../?code=... URL, no custom-scheme navigation required.

Install (unpacked)

1. Download or clone this repository.
2. Open chrome://extensions.
3. Enable Developer mode (top-right).
4. Click Load unpacked and select the extension/ folder.
5. (Optional, if you use a private/incognito window) open the extension's details and enable Allow in Incognito.

Usage

1. Go to your Ford/Lincoln login page (e.g. https://login.ford.nl/...).
2. A blue balloon appears top-right: "waiting for token…".
3. Log in. When the redirect happens the balloon turns green, shows the full fordapp://userauthorized/?code=... URL, and gives you a Copy to clipboard button.
4. Paste that URL into the Home Assistant / FordPass setup dialog.

If the balloon stays on "waiting", open the service worker console (chrome://extensions → the extension → service worker) and look for [Ford Token Grabber] Captured:.

Supported domains

The manifest declares an explicit list of login.ford.<tld> and login.lincoln.<tld> hosts (Chrome match patterns don't allow a wildcard in the TLD). The background script additionally filters with the regex ^login\.(ford|lincoln)\. so any Ford/Lincoln login host is handled. If your region's TLD is missing from the manifest, add it to host_permissions and the content-script matches (see Adding a TLD).

Adding a TLD

Add "*://login.ford.<tld>/*" to both the host_permissions array and the content_scripts[0].matches array in extension/manifest.json, then reload the extension.

Repository structure

.
├── extension/          # the loadable Chrome extension
│   ├── manifest.json
│   ├── background.js
│   ├── content.js
│   └── icons/
├── README.md
├── PRIVACY.md
├── CHANGELOG.md
├── LICENSE
└── .gitignore

Point Load unpacked at the extension/ folder — not the repository root.

How it works

• extension/background.js — listens on webRequest.onBeforeRedirect (and onHeadersReceived as a fallback), extracts the token URL, stores it in chrome.storage.local, and messages the tab.
• extension/content.js — renders the balloon and displays the token when it receives the message (or finds a fresh one in storage on load).

Permissions

• webRequest — read the redirect Location header (observe-only; no blocking).
• storage — briefly hold the captured URL so a late-loading frame can still show it (kept for 2 minutes).
• scripting — reserved for the content-script plumbing.
• host_permissions — restricted to Ford/Lincoln login hosts only.

Privacy

The extension runs only on Ford/Lincoln login domains and only reacts to the OAuth redirect. The captured URL never leaves your browser: it is shown in the balloon and kept in local storage for at most two minutes. Nothing is sent anywhere. See PRIVACY.md.

Disclaimer

Not affiliated with, endorsed by, or connected to Ford Motor Company or Lincoln. "Ford" and "Lincoln" are trademarks of their respective owners. Use at your own risk, on your own account.

License

MIT