Since the KP303 Hardware (2.0 US), Firmware (1.1.2) is already available, it would be great if python-kasa could support it. Once the KP303 is upgraded, we cannot downgrade it, and Home Assistant stops supporting it
Did you try with the cli tool, does it detect the device as unsupported? Would you mind posting the discovery output to check what encryption parameters it is offering?
I just tried the CLI, and it doesn't say unsupported. Instead, it says Authentication failed for device, even when I try to log in using my TP-LINK cloud username and password.
== Authentication failed for device ==
== Discovery Result ==
Device Type: IOT.SMARTPLUGSWITCH
Device Model: KP303(US)
IP: 192.168.1.98
MAC: 5C-62-8B-0A-9C-90
Device Id (hash): ***************************************
Owner (hash): ***************************************
HW Ver: 2.0
OBD Src: tplink
Encrypt Type: KLAP
HTTP Port: 80
Login version: 2
== TP-LINK_Power Strip_7B97 - KP303 ==Host: 192.168.1.98Port: 9999Device state: TrueTime: 2025-09-14 11:18:59-07:00 (tz: PST8PDT)Hardware: 2.0 (US)Firmware: 1.1.2 Build 241220 Rel.173321MAC (rssi): 5C:62:8B:0A:9C:90 (-38)
== Primary features ==State (state): True
== Information ==On since (on_since): 2025-09-13 17:42:39-07:00Cloud connection (cloud_connection): True
== Configuration ==LED (led): True
== Debug ==RSSI (rssi): -38 dBmReboot (reboot): <Action>
== Children ==
== Plug 1 (Socket for KP303(US)) ==
== Primary features == State (state): True
== Information == On since (on_since): 2025-09-14 00:30:45-07:00
== Configuration ==
== Debug ==
== Plug 2 (Socket for KP303(US)) ==
== Primary features == State (state): True
== Information == On since (on_since): 2025-09-14 10:29:59-07:00
== Configuration ==
== Debug ==
== Plug 3 (Socket for KP303(US)) ==
== Primary features == State (state): True
== Information == On since (on_since): 2025-09-13 17:42:39-07:00
== Configuration ==
== Debug ==
Home assistant opens the below dialog to add KP303 since it's upgraded to 1.1.2 but always says: Unable to authenticate: Device response did not match our challenge on ip x.x.x.x, check that your e-mail and password (both case-sensitive) are correct. I enabled the Third Party Compatibility and disabled two steps Verification at Kasa/Tapo apps.
I have tried disabling / re-enabling third-party access in Kasa app, and the KP303 just won't work. It rejects authentication attempts. I think it's a real issue with the specific firmware.
I ran kasa feature with a debug flag, and got this, perhaps this would be helpful, @rytilahti:
➜ python-kasa git:(master) uv run kasa --debug --host 192.168.1.29 feature
warning: The `tool.uv.dev-dependencies` field (used in `pyproject.toml`) is deprecated and will be removed in a future release; use `dependency-groups.dev` instead
Discovering device 192.168.1.29 for 10 seconds
DEBUG [DISCOVERY] 192.168.1.29 >> {'system': {'get_sysinfo': {}}} discover.py:326
DEBUG Waiting a total of 10 seconds for responses... discover.py:587
DEBUG Using IotPlug for IOT.SMARTPLUGSWITCH device_factory.py:179
DEBUG Finding protocol for 192.168.1.29 device_factory.py:194
DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch device_factory.py:197
DEBUG Finding transport for IOT.KLAP device_factory.py:226
DEBUG Created KLAP transport for 192.168.1.29 klaptransport.py:141
DEBUG [DISCOVERY] 192.168.1.29 << {'error_code': 0, discover.py:924
'result': {'device_id': 'REDACTED_14d03011c41ac4133926e5e',
'device_model': 'KP303(US)',
'device_type': 'IOT.SMARTPLUGSWITCH',
'factory_default': False,
'hw_ver': '2.0',
'ip': '192.168.1.29',
'mac': 'DC-62-79-00-00-00',
'mgt_encrypt_schm': {'ANS': False,
'encrypt_type': 'KLAP',
'http_port': 80,
'is_support_https': False,
'lv': 2,
'new_klap': 1},
'obd_src': 'tplink',
'owner': 'REDACTED_9F5A09802A52E86529D5514',
'protocol_version': 1}}
DEBUG Initializing 192.168.1.29 of type <class 'kasa.iot.iotplug.IotPlug'> device.py:212
DEBUG Performing the initial update to obtain sysinfo iotdevice.py:314
DEBUG 192.168.1.29 >> {"system":{"get_sysinfo":{}}} iotprotocol.py:143
DEBUG Starting handshake with 192.168.1.29 klaptransport.py:317
DEBUG Posting to http://192.168.1.29/app/handshake1 httpclient.py:88
DEBUG Handshake1 posted at 2025-09-21 00:07:21.934326. Host is 192.168.1.29, Response status is 200, Request was klaptransport.py:182
59a3662893fded6c6c6c3181d60420b6
DEBUG Handshake1 success at 2025-09-21 00:07:21.936786. Host is 192.168.1.29, Server remote_seed is: klaptransport.py:207
b28e73df17d6f3dfcf04f3df1d68f3df, server hash is: 1bd23b7ada2c8dac540f0b294566df9ab5b8928c97e6961401419487f54be8af
DEBUG Device response did not match our challenge on ip 192.168.1.29, check that your e-mail and password (both klaptransport.py:272
case-sensitive) are correct.
DEBUG Unable to authenticate with 192.168.1.29, not retrying iotprotocol.py:96
Raised error: Device response did not match our challenge on ip 192.168.1.29, check that your e-mail and password (both case-sensitive) are correct.
Traceback (most recent call last):
File "/Users/allen/Repositories/python-kasa/.venv/bin/kasa", line 10, in <module>
sys.exit(cli())
~~~^^
File "/Users/allen/Repositories/python-kasa/kasa/cli/common.py", line 282, in __call__
asyncio.run(self.main(*args, **kwargs))
~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/runners.py", line 195, in run
return runner.run(main)
~~~~~~~~~~^^^^^^
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/runners.py", line 118, in run
return self._loop.run_until_complete(task)
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/base_events.py", line 725, in run_until_complete
return future.result()
~~~~~~~~~~~~~^^
File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/asyncclick/core.py", line 1126, in main
rv = await self.invoke(ctx)
^^^^^^^^^^^^^^^^^^^^^^
File "/Users/allen/Repositories/python-kasa/kasa/cli/common.py", line 270, in invoke
_handle_exception(self._debug, exc)
~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^
File "/Users/allen/Repositories/python-kasa/kasa/cli/common.py", line 268, in invoke
return await super().invoke(ctx)
^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/asyncclick/core.py", line 1747, in invoke
await super().invoke(ctx)
File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/asyncclick/core.py", line 1496, in invoke
return await ctx.invoke(self.callback, **ctx.params)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/asyncclick/core.py", line 829, in invoke
rv = await rv
^^^^^^^^
File "/Users/allen/Repositories/python-kasa/kasa/cli/main.py", line 370, in cli
await dev.update()
File "/Users/allen/Repositories/python-kasa/kasa/iot/iotdevice.py", line 315, in update
response = await self.protocol.query(req)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/allen/Repositories/python-kasa/kasa/protocols/iotprotocol.py", line 83, in query
return await self._query(request, retry_count)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/allen/Repositories/python-kasa/kasa/protocols/iotprotocol.py", line 99, in _query
raise auex
File "/Users/allen/Repositories/python-kasa/kasa/protocols/iotprotocol.py", line 88, in _query
return await self._execute_query(request, retry)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/allen/Repositories/python-kasa/kasa/protocols/iotprotocol.py", line 148, in _execute_query
resp = await self._transport.send(request)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/allen/Repositories/python-kasa/kasa/transports/klaptransport.py", line 354, in send
await self.perform_handshake()
File "/Users/allen/Repositories/python-kasa/kasa/transports/klaptransport.py", line 322, in perform_handshake
local_seed, remote_seed, auth_hash = await self.perform_handshake1()
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/Users/allen/Repositories/python-kasa/kasa/transports/klaptransport.py", line 273, in perform_handshake1
raise AuthenticationError(msg)
kasa.exceptions.AuthenticationError: Device response did not match our challenge on ip 192.168.1.29, check that your e-mail and password (both case-sensitive) are correct.
Exception ignored in: <function ClientSession.__del__ at 0x111a177e0>
Traceback (most recent call last):
File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/aiohttp/client.py", line 443, in __del__
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/base_events.py", line 1906, in call_exception_handler
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1551, in error
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1667, in _log
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1686, in handle
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1744, in callHandlers
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1027, in handle
File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/rich/logging.py", line 168, in emit
File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/rich/logging.py", line 229, in render
File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/rich/_log_render.py", line 43, in __call__
ImportError: sys.meta_path is None, Python is likely shutting down
Exception ignored in: <function BaseConnector.__del__ at 0x11194fa60>
Traceback (most recent call last):
File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/aiohttp/connector.py", line 333, in __del__
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/base_events.py", line 1906, in call_exception_handler
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1551, in error
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1667, in _log
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1686, in handle
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1744, in callHandlers
File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1027, in handle
File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/rich/logging.py", line 168, in emit
File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/rich/logging.py", line 229, in render
File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/rich/_log_render.py", line 43, in __call__
ImportError: sys.meta_path is None, Python is likely shutting down
@rytilahti — anything I can do to help investigate and figure out how to connect to it? I’m guessing they are going to eventually push this firmware to all of their devices, and it can become a much bigger problem.
Someone needs to figure out the protocol in use, most likely by reverse engineering the app and/or the communications. Alas, it is not a very simple procedure, so I'm not going to try to explain it stepwise here. If this new protocol gets more popular, I hope someone will figure out how it works and contribute to this project :-)
Now, there is some tooling under the devtools directory that allows decrypting klap communications (and there is some other tooling linked in some issues in this repository), but they are likely only useful after the key exchange is figured out. Just a guess based on that discovery payload, which hints that klap would still be in use, but the key derivation has been changed.
I have noticed in troubleshooting pieces in my Homebridge plugin, I had a user with a Mac that was able to use the Tapo/Kasa App and Wireshark to help decrypt some things. Not sure if anyone here has that kind of setup with these new device firmwares but it might help point in the right direction.
I was indeed talking about the same tooling, but couldn't find a link right off the bat. If you have it, feel free to link it! As I mentioned, it might be a new way to perform the key exchange, but it might still be useful :-) iirc, I mentioned that it'd be great to have it linked in the readme, as it is useful also for figuring out new commands etc., but saw no PR to add it.
I am not sure if it would work with this here, but it may be worth a shot for someone to try out?
I had my user use just a Mac/Macbook with the Native Tapo App installed, and they were running Wireshark as well filtered down to the IP Address of the device we were communicating with. This would give the communication between the device and the Tapo App which may help with reverse engineering this as well.
If someone has a Mac/Macbook and can install the Native Tapo App and run a full packet capture for communication between the App and the device, if they would be willing to share that via Discord with me, I might be able to look at it and see if we could figure out how to reverse engineer this new communication protocol or at least get us pointed in the right direction.
@ZeliardM -- I can try doing that: I am on a Mac, and can grab the Tapo app. My Wireshark foo is not very strong, but I'll try poking around; or happy to get on a screen sharing session and take directions. I am very invested in getting this figured out: my house is full of TP-Link hardware (57 light switches, a dozen smart outlets, a bunch of smart plugs, and this power strip that isn't working anymore) and if this new firmware spreads and disconnects all my hardware from Home Assistant, it'll be as good as useless.
@allenrabinovich Understood. Yea, if you want to give it a shot and try grabbing some pcap files from Wireshark, my Discord handle is the same as my username here so just drop me an invite and we can start sharing from there to see what we can find out. Having the Mac to run the Native App is a huge help right off the bat.
This fixed it on mine ,they did something screwy with encryption/firmware and the latest forced update on my newly purchased HS300 rendered it useless in homeassistant. home-assistant/core#160570 (comment)
There hasn't been any activity on this issue recently. This issue has been automatically marked as stale because of that. It will be closed if no further activity occurs.
Please make sure to update to the latest python-kasa version and check if that solves the issue.
Thank you for your contributions.
There hasn't been any activity on this issue recently. This issue has been automatically marked as stale because of that. It will be closed if no further activity occurs.
Please make sure to update to the latest python-kasa version and check if that solves the issue.
Thank you for your contributions.
Activity
rytilahti commented on Sep 14, 2025
Did you try with the cli tool, does it detect the device as unsupported? Would you mind posting the discovery output to check what encryption parameters it is offering?
mehrdadrad commented on Sep 14, 2025
I just tried the CLI, and it doesn't say unsupported. Instead, it says Authentication failed for device, even when I try to log in using my TP-LINK cloud username and password.
Home assistant opens the below dialog to add KP303 since it's upgraded to 1.1.2 but always says: Unable to authenticate: Device response did not match our challenge on ip x.x.x.x, check that your e-mail and password (both case-sensitive) are correct. I enabled the Third Party Compatibility and disabled two steps Verification at Kasa/Tapo apps.
mellodev commented on Sep 18, 2025
Same issue here with KP303 and 1.1.2, in HA I'm seeing an auth error when the credentials are correct. What is the status of this issue?
v1ct0rv commented on Sep 18, 2025
I' ve able to control my devices again, I enable third-party access in Kasa App and the devices starts working again.
If you have it enabled, disable it and enable it again.
allenrabinovich commented on Sep 21, 2025
I have tried disabling / re-enabling third-party access in Kasa app, and the KP303 just won't work. It rejects authentication attempts. I think it's a real issue with the specific firmware.
allenrabinovich commented on Sep 21, 2025
I ran kasa feature with a debug flag, and got this, perhaps this would be helpful, @rytilahti:
➜ python-kasa git:(master) uv run kasa --debug --host 192.168.1.29 feature warning: The `tool.uv.dev-dependencies` field (used in `pyproject.toml`) is deprecated and will be removed in a future release; use `dependency-groups.dev` instead Discovering device 192.168.1.29 for 10 seconds DEBUG [DISCOVERY] 192.168.1.29 >> {'system': {'get_sysinfo': {}}} discover.py:326 DEBUG Waiting a total of 10 seconds for responses... discover.py:587 DEBUG Using IotPlug for IOT.SMARTPLUGSWITCH device_factory.py:179 DEBUG Finding protocol for 192.168.1.29 device_factory.py:194 DEBUG Finding protocol for DeviceFamily.IotSmartPlugSwitch device_factory.py:197 DEBUG Finding transport for IOT.KLAP device_factory.py:226 DEBUG Created KLAP transport for 192.168.1.29 klaptransport.py:141 DEBUG [DISCOVERY] 192.168.1.29 << {'error_code': 0, discover.py:924 'result': {'device_id': 'REDACTED_14d03011c41ac4133926e5e', 'device_model': 'KP303(US)', 'device_type': 'IOT.SMARTPLUGSWITCH', 'factory_default': False, 'hw_ver': '2.0', 'ip': '192.168.1.29', 'mac': 'DC-62-79-00-00-00', 'mgt_encrypt_schm': {'ANS': False, 'encrypt_type': 'KLAP', 'http_port': 80, 'is_support_https': False, 'lv': 2, 'new_klap': 1}, 'obd_src': 'tplink', 'owner': 'REDACTED_9F5A09802A52E86529D5514', 'protocol_version': 1}} DEBUG Initializing 192.168.1.29 of type <class 'kasa.iot.iotplug.IotPlug'> device.py:212 DEBUG Performing the initial update to obtain sysinfo iotdevice.py:314 DEBUG 192.168.1.29 >> {"system":{"get_sysinfo":{}}} iotprotocol.py:143 DEBUG Starting handshake with 192.168.1.29 klaptransport.py:317 DEBUG Posting to http://192.168.1.29/app/handshake1 httpclient.py:88 DEBUG Handshake1 posted at 2025-09-21 00:07:21.934326. Host is 192.168.1.29, Response status is 200, Request was klaptransport.py:182 59a3662893fded6c6c6c3181d60420b6 DEBUG Handshake1 success at 2025-09-21 00:07:21.936786. Host is 192.168.1.29, Server remote_seed is: klaptransport.py:207 b28e73df17d6f3dfcf04f3df1d68f3df, server hash is: 1bd23b7ada2c8dac540f0b294566df9ab5b8928c97e6961401419487f54be8af DEBUG Device response did not match our challenge on ip 192.168.1.29, check that your e-mail and password (both klaptransport.py:272 case-sensitive) are correct. DEBUG Unable to authenticate with 192.168.1.29, not retrying iotprotocol.py:96 Raised error: Device response did not match our challenge on ip 192.168.1.29, check that your e-mail and password (both case-sensitive) are correct. Traceback (most recent call last): File "/Users/allen/Repositories/python-kasa/.venv/bin/kasa", line 10, in <module> sys.exit(cli()) ~~~^^ File "/Users/allen/Repositories/python-kasa/kasa/cli/common.py", line 282, in __call__ asyncio.run(self.main(*args, **kwargs)) ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/runners.py", line 195, in run return runner.run(main) ~~~~~~~~~~^^^^^^ File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/runners.py", line 118, in run return self._loop.run_until_complete(task) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/base_events.py", line 725, in run_until_complete return future.result() ~~~~~~~~~~~~~^^ File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/asyncclick/core.py", line 1126, in main rv = await self.invoke(ctx) ^^^^^^^^^^^^^^^^^^^^^^ File "/Users/allen/Repositories/python-kasa/kasa/cli/common.py", line 270, in invoke _handle_exception(self._debug, exc) ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^ File "/Users/allen/Repositories/python-kasa/kasa/cli/common.py", line 268, in invoke return await super().invoke(ctx) ^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/asyncclick/core.py", line 1747, in invoke await super().invoke(ctx) File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/asyncclick/core.py", line 1496, in invoke return await ctx.invoke(self.callback, **ctx.params) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/asyncclick/core.py", line 829, in invoke rv = await rv ^^^^^^^^ File "/Users/allen/Repositories/python-kasa/kasa/cli/main.py", line 370, in cli await dev.update() File "/Users/allen/Repositories/python-kasa/kasa/iot/iotdevice.py", line 315, in update response = await self.protocol.query(req) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/allen/Repositories/python-kasa/kasa/protocols/iotprotocol.py", line 83, in query return await self._query(request, retry_count) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/allen/Repositories/python-kasa/kasa/protocols/iotprotocol.py", line 99, in _query raise auex File "/Users/allen/Repositories/python-kasa/kasa/protocols/iotprotocol.py", line 88, in _query return await self._execute_query(request, retry) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/allen/Repositories/python-kasa/kasa/protocols/iotprotocol.py", line 148, in _execute_query resp = await self._transport.send(request) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/allen/Repositories/python-kasa/kasa/transports/klaptransport.py", line 354, in send await self.perform_handshake() File "/Users/allen/Repositories/python-kasa/kasa/transports/klaptransport.py", line 322, in perform_handshake local_seed, remote_seed, auth_hash = await self.perform_handshake1() ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/Users/allen/Repositories/python-kasa/kasa/transports/klaptransport.py", line 273, in perform_handshake1 raise AuthenticationError(msg) kasa.exceptions.AuthenticationError: Device response did not match our challenge on ip 192.168.1.29, check that your e-mail and password (both case-sensitive) are correct. Exception ignored in: <function ClientSession.__del__ at 0x111a177e0> Traceback (most recent call last): File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/aiohttp/client.py", line 443, in __del__ File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/base_events.py", line 1906, in call_exception_handler File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1551, in error File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1667, in _log File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1686, in handle File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1744, in callHandlers File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1027, in handle File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/rich/logging.py", line 168, in emit File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/rich/logging.py", line 229, in render File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/rich/_log_render.py", line 43, in __call__ ImportError: sys.meta_path is None, Python is likely shutting down Exception ignored in: <function BaseConnector.__del__ at 0x11194fa60> Traceback (most recent call last): File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/aiohttp/connector.py", line 333, in __del__ File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/asyncio/base_events.py", line 1906, in call_exception_handler File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1551, in error File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1667, in _log File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1686, in handle File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1744, in callHandlers File "/usr/local/Cellar/python@3.13/3.13.5/Frameworks/Python.framework/Versions/3.13/lib/python3.13/logging/__init__.py", line 1027, in handle File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/rich/logging.py", line 168, in emit File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/rich/logging.py", line 229, in render File "/Users/allen/Repositories/python-kasa/.venv/lib/python3.13/site-packages/rich/_log_render.py", line 43, in __call__ ImportError: sys.meta_path is None, Python is likely shutting downrytilahti commented on Sep 21, 2025
'mgt_encrypt_schm': {'ANS': False, 'encrypt_type': 'KLAP', 'http_port': 80, 'is_support_https': False, 'lv': 2, 'new_klap': 1},I haven't ever seen ANS and new_klap keys until now, so I'd guess this device is using a new encryption method.
allenrabinovich commented on Sep 21, 2025
@rytilahti — anything I can do to help investigate and figure out how to connect to it? I’m guessing they are going to eventually push this firmware to all of their devices, and it can become a much bigger problem.
rytilahti commented on Sep 21, 2025
Someone needs to figure out the protocol in use, most likely by reverse engineering the app and/or the communications. Alas, it is not a very simple procedure, so I'm not going to try to explain it stepwise here. If this new protocol gets more popular, I hope someone will figure out how it works and contribute to this project :-)
Now, there is some tooling under the devtools directory that allows decrypting klap communications (and there is some other tooling linked in some issues in this repository), but they are likely only useful after the key exchange is figured out. Just a guess based on that discovery payload, which hints that klap would still be in use, but the key derivation has been changed.
ZeliardM commented on Sep 21, 2025
I have noticed in troubleshooting pieces in my Homebridge plugin, I had a user with a Mac that was able to use the Tapo/Kasa App and Wireshark to help decrypt some things. Not sure if anyone here has that kind of setup with these new device firmwares but it might help point in the right direction.
rytilahti commented on Sep 21, 2025
I was indeed talking about the same tooling, but couldn't find a link right off the bat. If you have it, feel free to link it! As I mentioned, it might be a new way to perform the key exchange, but it might still be useful :-) iirc, I mentioned that it'd be great to have it linked in the readme, as it is useful also for figuring out new commands etc., but saw no PR to add it.
ZeliardM commented on Sep 21, 2025
@rytilahti I believe the tool you're talking about that someone mentioned was this:
https://github.com/cavefire/tapo-klap-mitm
I am not sure if it would work with this here, but it may be worth a shot for someone to try out?
I had my user use just a Mac/Macbook with the Native Tapo App installed, and they were running Wireshark as well filtered down to the IP Address of the device we were communicating with. This would give the communication between the device and the Tapo App which may help with reverse engineering this as well.
If someone has a Mac/Macbook and can install the Native Tapo App and run a full packet capture for communication between the App and the device, if they would be willing to share that via Discord with me, I might be able to look at it and see if we could figure out how to reverse engineer this new communication protocol or at least get us pointed in the right direction.
allenrabinovich commented on Sep 22, 2025
@ZeliardM -- I can try doing that: I am on a Mac, and can grab the Tapo app. My Wireshark foo is not very strong, but I'll try poking around; or happy to get on a screen sharing session and take directions. I am very invested in getting this figured out: my house is full of TP-Link hardware (57 light switches, a dozen smart outlets, a bunch of smart plugs, and this power strip that isn't working anymore) and if this new firmware spreads and disconnects all my hardware from Home Assistant, it'll be as good as useless.
ZeliardM commented on Sep 22, 2025
@allenrabinovich Understood. Yea, if you want to give it a shot and try grabbing some pcap files from Wireshark, my Discord handle is the same as my username here so just drop me an invite and we can start sharing from there to see what we can find out. Having the Mac to run the Native App is a huge help right off the bat.
ZeliardM commented on Sep 23, 2025
@allenrabinovich Any luck or would you like to try and get together on Discord?
32 remaining items
interbiznw commented on Jan 20, 2026
This fixed it on mine ,they did something screwy with encryption/firmware and the latest forced update on my newly purchased HS300 rendered it useless in homeassistant. home-assistant/core#160570 (comment)
tnking83 commented on Feb 5, 2026
I was able to fix my issue by following the steps in a comment on this issue: home-assistant/core#153390 (comment)
srtviperjr commented on Feb 27, 2026
./sigh the patch doesn't work now on 2026.2.3 worked for all previous versions. Any idea how to update it?
pcabido commented on Mar 1, 2026
I updated the script to handle the changes in python-kasa-0.10.2. I didn't replace the other gist, I created a new one instead: https://gist.github.com/pcabido/e89034e78627efb9795133dd5827e604
srtviperjr commented on Mar 1, 2026
You're a gem! Thank you!
Route IOT.KLAP by login_version and refine Plug/Strip class on connect
github-actions commented on May 31, 2026
There hasn't been any activity on this issue recently. This issue has been automatically marked as stale because of that. It will be closed if no further activity occurs.
Please make sure to update to the latest python-kasa version and check if that solves the issue.
Thank you for your contributions.
leftyfb commented on May 31, 2026
It's still broken
github-actions commented on Aug 31, 2026
There hasn't been any activity on this issue recently. This issue has been automatically marked as stale because of that. It will be closed if no further activity occurs.
Please make sure to update to the latest python-kasa version and check if that solves the issue.
Thank you for your contributions.
SirBabaYaga commented on Aug 31, 2026
do we assume this has been abandoned? not sure haven’t dealt with an issue before.
LeeThompson commented on Aug 31, 2026
It's the stupid github action that marks things as stale over time, really foolish practice really...