Riot ID: 8Apoptosis#222 (EUW). Active League of Legends player, not an account
created solely for the Developer Portal.
I also created a second, brand-new account purely to test whether this was
account-specific. That account exhibits the identical failure.
I cannot authenticate on any Riot web property, which blocks access to the
Developer Portal and therefore to obtaining an API key. The League of Legends
game client logs in normally with the same credentials.
The login page displays: "Oops! Something went wrong. Sorry, we're having some
trouble right now. Please try again."
Failing request:
PUT https://authenticate.riotgames.com/api/v1/login
Status: HTTP/2 400
x-rso-error-id: 40000070
cf-ray: a2a801dfc9acea60-ARN
Timestamp: Thu, 13 Aug 2026 13:18:43 GMT
Response body:
{"type":"error","error":"invalid_request","country":"swe","captcha":{"type":"hcaptcha","hcaptcha":{...}}}
The hCaptcha subdocument loads (HTTP 200), api.hcaptcha.com/checksiteconfig
returns HTTP 200, and the login request carries a full captcha token (request
body 4143 bytes). The request passes Cloudflare and is then rejected by RSO at
the application layer, which returns a fresh captcha challenge that the login
UI never renders.
- Logged out of the Developer Portal and cleared all riotgames.com session state
- Incognito / private windows
- Cleared browser cookies, cache and site data for riotgames.com and subdomains
- Secondary devices: desktop and Android mobile, both fail identically
- Four browsers: Firefox, Brave, DuckDuckGo, and the default browser on Android
- Two networks: fixed residential broadband and 5G mobile, two different public
IP addresses on separate autonomous systems
- No VPN and no proxy at any point; VPN client verified fully disconnected
- System clock verified NTP-synchronised (skewed clocks can invalidate captcha
tokens; ruled out)
Behaviour is identical in every combination. The standard account-side
troubleshooting has been exhausted.
Most significantly: I registered a brand-new account via
signup.leagueoflegends.com from the same IP address and browser. Registration
completed successfully, including its captcha challenge. Logging in with that
new account immediately afterwards failed identically.
This rules out an account-level flag, and it rules out an IP or edge-level
block, since the signup flow's captcha validated correctly from the same
address minutes earlier.
- From a Swedish IP address (country code resolves to "swe"), open
https://developer.riotgames.com or any Riot web property and click log in.
- Enter valid credentials and complete the hCaptcha challenge.
- Submit. The PUT to authenticate.riotgames.com/api/v1/login returns HTTP 400
with x-rso-error-id: 40000070 and error "invalid_request", despite a valid
captcha token being attached.
- The generic error page is displayed with no path to proceed.
Ongoing for approximately one week, continuous, no intermittent successes.
The defect appears isolated to captcha validation on the login endpoint for
country code SWE, while the equivalent validation step in the registration
flow functions correctly.
Player support ticket #137520096 is open but is queued as account recovery,
which is the wrong team. This is not an account recovery request.
The same signature was reported in #873 (December 2023, country: lva) and
closed as not planned without investigation.
Requesting that RSO logs be checked against error ID 40000070 for country
code SWE. I can supply a HAR capture on request.
Riot ID: 8Apoptosis#222 (EUW). Active League of Legends player, not an account
created solely for the Developer Portal.
I also created a second, brand-new account purely to test whether this was
account-specific. That account exhibits the identical failure.
I cannot authenticate on any Riot web property, which blocks access to the
Developer Portal and therefore to obtaining an API key. The League of Legends
game client logs in normally with the same credentials.
The login page displays: "Oops! Something went wrong. Sorry, we're having some
trouble right now. Please try again."
Failing request:
PUT https://authenticate.riotgames.com/api/v1/login
Status: HTTP/2 400
x-rso-error-id: 40000070
cf-ray: a2a801dfc9acea60-ARN
Timestamp: Thu, 13 Aug 2026 13:18:43 GMT
Response body:
{"type":"error","error":"invalid_request","country":"swe","captcha":{"type":"hcaptcha","hcaptcha":{...}}}
The hCaptcha subdocument loads (HTTP 200), api.hcaptcha.com/checksiteconfig
returns HTTP 200, and the login request carries a full captcha token (request
body 4143 bytes). The request passes Cloudflare and is then rejected by RSO at
the application layer, which returns a fresh captcha challenge that the login
UI never renders.
IP addresses on separate autonomous systems
tokens; ruled out)
Behaviour is identical in every combination. The standard account-side
troubleshooting has been exhausted.
Most significantly: I registered a brand-new account via
signup.leagueoflegends.com from the same IP address and browser. Registration
completed successfully, including its captcha challenge. Logging in with that
new account immediately afterwards failed identically.
This rules out an account-level flag, and it rules out an IP or edge-level
block, since the signup flow's captcha validated correctly from the same
address minutes earlier.
https://developer.riotgames.com or any Riot web property and click log in.
with x-rso-error-id: 40000070 and error "invalid_request", despite a valid
captcha token being attached.
Ongoing for approximately one week, continuous, no intermittent successes.
The defect appears isolated to captcha validation on the login endpoint for
country code SWE, while the equivalent validation step in the registration
flow functions correctly.
Player support ticket #137520096 is open but is queued as account recovery,
which is the wrong team. This is not an account recovery request.
The same signature was reported in #873 (December 2023, country: lva) and
closed as not planned without investigation.
Requesting that RSO logs be checked against error ID 40000070 for country
code SWE. I can supply a HAR capture on request.