AEP-family (PSO) login rejected with generic "password requirements changed" error — website login succeeds with identical credentials #211

Utility: psoklahoma (Public Service Company of Oklahoma, AEP subsidiary)
opower version: 0.19.0
HA version: 2026.8.1 (also reproduced standalone, outside HA, via python -m opower)

Steps to reproduce:

python -m opower --utility psoklahoma -v --usage_only

Error:

opower.exceptions.InvalidAuth: Our password requirements recently changed. Please <a href="/account/forgot-password/">reset your password</a>. <br /><br />If you've already reset it, check your password and try again.

Raised from utilities/aepbase.py:104, parsed from a class="error" element in the HTML response to the login POST to /account/usage/.

Why I don't believe this is actually a password problem:

• The same credentials log into the PSO website (psoklahoma.com) without issue, immediately before and after this failure.
• No MFA is enabled on the account (and PSO's portal has no option to enable it).
• Already ruled out: clipboard-paste artifacts (manually retyped credentials, same failure), and special characters in the password (changed to a password avoiding all of them, same failure).
• The failure is intermittent, not constant: the exact same credentials succeeded via this same CLI tool, and immediately after via Home Assistant's own config flow, then failed again ~4 hours later during Home Assistant's routine background token refresh (a different error that run: Invalid token response structure from AEP), and now fails again with the error above on a fresh manual run.

This pattern — a real browser login succeeding while a scripted POST to the identical form URL gets a generic/boilerplate rejection, intermittently — looks more consistent with either a new required field in AEP's login form (CSRF/bot-detection token AEPLoginParser isn't extracting) or bot-detection on the non-browser request path, than with an actual account/password issue. Filing in case others on AEP-family utilities (Ohio, Texas, PSO all share this base class) are hitting the same thing — happy to provide more diagnostic detail if useful.