Repository navigation
Out of box Tapo TC40: discovery not working, authentication failure on wifi setup #1628
Description
Hi!
I had the misfortune to get a TP-Link Tapo TC40 IP camera, which I intend to use with Frigate through the local RTSP stream.
I wanted to set it up without connecting it to the internet, and registering for any cloud service, and I read in the Home Assistant docs (here) that python-kasa should work for provisioning most TP-Link devices, but something is wrong and I cant even scan for wifi networks with it. I have factory resetted it just in case, but that did not help.
I have installed python-kasa 0.10.2 with pip, on python 3.12.
If I run the discovery command while the laptop is connected to the camera's wifi network, I get 0 results:
$ kasa discover Discovering devices on 255.255.255.255 for 10 seconds Found 0 devices
Since my laptop receives the IP address 192.168.191.100 on this network, and the default gateway IP is 192.168.191.1, which I can ping, I tried to run a discovery for this IP range too, without success:
$ kasa --target 192.168.191.255 discover Discovering devices on 192.168.191.255 for 10 seconds Found 0 devices
Next I though I'll continue with the next steps in the provisioning instructions, however it seems I cannot start a wifi scan with it either:
$ kasa --host 192.168.191.1 wifi scan Discovering device 192.168.191.1 for 10 seconds Raised error: Device response did not match our challenge on ip 192.168.191.1, check that your e-mail and password (both case-sensitive) are correct. Run with --debug enabled to see stacktrace ERROR:asyncio:Unclosed client session client_session: <aiohttp.client.ClientSession object at 0x7f418d2ab5c0>
Detailed output with --debug:
$ kasa --debug --host 192.168.191.1 wifi scan
Discovering device 192.168.191.1 for 10 seconds
DEBUG:kasa.discover:[DISCOVERY] 192.168.191.1 >> {'system': {'get_sysinfo': {}}}
DEBUG:kasa.discover:Waiting a total of 10 seconds for responses...
DEBUG:kasa.discover:Decrypted encrypt_info for 192.168.191.1: {'connect_ssid': '',
'connect_type': 'wireless',
'device_id': 'REDACTED',
'http_port': 443,
'last_alarm_time': '0',
'last_alarm_type': '',
'owner': '',
'sd_status': 'offline'}
DEBUG:kasa.device_factory:Using SmartCamDevice for SMART.IPCAMERA
DEBUG:kasa.device_factory:Finding protocol for 192.168.191.1
DEBUG:kasa.device_factory:Finding protocol for DeviceFamily.SmartIpCamera
DEBUG:kasa.transports.sslaestransport:Created AES transport for 192.168.191.1
DEBUG:kasa.discover:[DISCOVERY] 192.168.191.1 << {'error_code': 0,
'result': {'device_id': 'REDACTED_D164F44270DB784055D1852',
'device_model': 'TC40',
'device_name': '#MASKED_NAME#',
'device_type': 'SMART.IPCAMERA',
'encrypt_info': {'data': '', 'key': '', 'sym_schm': 'AES'},
'encrypt_type': ['3'],
'factory_default': True,
'firmware_version': '1.0.4 Build 240902 Rel.38194n',
'hardware_version': '2.0',
'ip': '192.168.191.1',
'isResetWiFi': False,
'is_support_iot_cloud': True,
'mac': 'REDACTED',
'mgt_encrypt_schm': {'is_support_https': True},
'protocol_version': 1}}
DEBUG:kasa.device:Initializing 192.168.191.1 of type <class 'kasa.smartcam.smartcamdevice.SmartCamDevice'>
DEBUG:kasa.protocols.smartprotocol:192.168.191.1 multi-request-batch-1-of-1 >> '{"method":"multipleRequest","request_time_milis":1767154616677,"terminal_uuid":"b+2BG4NWkAozOFExc2pgwA==","params":{"requests":[{"method":"getDeviceInfo","params":{"device_info":{"name":["basic_info","info"]}}},{"method":"getAppComponentList","params":{"app_component":{"name":"app_component_list"}}},{"method":"getConnectionType","params":{"network":{"get_connection_type":{}}}}]}}'
DEBUG:kasa.transports.sslaestransport:Trying default credentials to 192.168.191.1
DEBUG:kasa.transports.sslaestransport:Sending handshake1...
DEBUG:kasa.httpclient:Posting to https://192.168.191.1
DEBUG:kasa.transports.sslaestransport:Device responded with status 200: {'result': {'data': {'code': -40401, 'time': 7, 'max_time': 10, 'encrypt_type': ['3'], 'key': 'MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKv4a/AHIEzDPyDwLsqC5onkBX+/DPC7D0d/CG/m6kNiHFpjrgqssQmndF9sXQHURBa2lCnDIC5EMNbwXrxcyvsCAwEAAQ==', 'nonce': 'CB97EC007FBA2E01', 'device_confirm': '4C8E85943619F7681B2A78FF7F68B8074237A76618958A2EFA6851B54C785F15CB97EC007FBA2E015EC70B5A8ED8041B'}}, 'error_code': -40413}
DEBUG:kasa.transports.sslaestransport:Connected to 192.168.191.1 with default username
DEBUG:kasa.transports.sslaestransport:Device response did not match our challenge on ip 192.168.191.1, check that your e-mail and password (both case-sensitive) are correct.
DEBUG:kasa.protocols.smartprotocol:Unable to authenticate with 192.168.191.1, not retrying: Device response did not match our challenge on ip 192.168.191.1, check that your e-mail and password (both case-sensitive) are correct.
Raised error: Device response did not match our challenge on ip 192.168.191.1, check that your e-mail and password (both case-sensitive) are correct.
I have read warnings that the offline provisioning only works if it has never been set up with a cloud account before, but as far as I know this should be a brand new device. I got it in its original box, nicely wrapped in all the wrapping material.
I have seen #1590 and #1604 which seem to be somewhat related, could it be because it uses newer communication protocols? Though in my case encrypt_type is not TPAP or KLAP, but [3].
Activity
mpeter50 commented on Dec 31, 2025
I am thinking of just setting up this industrial waste with a throwaway account and a temporary internet connection, so please let me know if there is something I could test for you that I couldnt anymore after registering it.
mpeter50 commented on Dec 31, 2025
I have to correct myself, kasa discover works partially, but my firewall blocked the incoming connection.
This is the discovery result after fixing the firewall:
$ kasa discover Discovering devices on 255.255.255.255 for 10 seconds == Authentication failed for device == == Discovery Result == Device Type: SMART.IPCAMERA Device Model: TC40 Device Name: Tapo_Camera IP: 192.168.191.1 MAC: 3C-64-CF-REDACTED Device Id (hash): REDACTED FW Ver: 1.0.4 Build 240902 Rel.38194n HW Ver: 2.0 Supports IOT Cloud: True Factory Default: True Encrypt Type: ['3'] Supports HTTPS: True Encrypt info: EncryptionInfo(sym_schm='AES', key='d1YO/QObfjiIU3SwibJRkr5LkrnGoBfq5WEJ2bzUmeVOy1x7CkxupwUcgY8nS1vOmqVu6f1WfoZyQljTrp/IFE5FUExZ2MsrwUD9mG7DOwNgmV7NrY+nA/JO29DiAzc4jJjbW3yCWLYOYpFT10Of0/YifYZHKGrCAzpyOoqjGWxTCpmXxchHv7+FR7inFaGekcekWQWxKB1Q99V0po5rx81V6Ybggn2COf0VxyPD4J4ERwZVeN496SWJti1cmpkdrFkx5Cf43Yan5O9gjTPQCqqKK0aHUJGIqY1y92v96Ewhh8K0ECdY2eXkwfQxeRqQWpMa1cQQWKapoM8n8QB6AA==', data='rwzPhppa31UgSNJSbYJMYfSxQCij2ZfOYk0hCaOqWDY/WpvAlAhgaFQMpjbC2rFzC7qZ6Jftg6iBgbhRMKGh6raogCEqLkZ+iwq9WErT8LgNdFr+ALh+D54iDiggj/Oxv9qzaK/4ZFhwQolx2MayLWkeFpksKd5pkTXNV06ixZ+iNQJyay/KVKR3nC+ns0MILtiP4lXUNJ04LOsiwvT6qEssQlUT4LxZtLXOJlX0esF9a/xTcsNLTk1iruNhRqN/dch5w8ucTGwlWNxNeBuu3w==') Decrypted: {'connect_ssid': '', 'connect_type': 'wireless', 'device_id': 'REDACTED', 'http_port': 443, 'last_alarm_time': '0', 'last_alarm_type': '', 'owner': '', 'sd_status': 'offline'} Found 1 devices Found 1 devices that failed to authenticateLet me know if having any of the redacted strings would be useful.
Provisioning still fails at the wifi scan command, with the same error.
mpeter50 commented on Dec 31, 2025
In the response to handshake1, error_code holds -40413. According to the SmartErrorCode class this means INVALID_NONCE.
There is also -40401 at result.data.code in the same response, which maps to SESSION_EXPIRED.
Both of these are in SMART_RETRYABLE_ERRORS.
According to this, INVALID_NONCE here just means that I need to perform secure login, authentication with just a username was not enough.
Does secure login mean email+password? What does this device expect if it hasnt been set up before?
mpeter50 commented on Jan 4, 2026
I have checked what both python-kasa and a recent version (3.15.118) of the tapo android app is doing, and it seems as if this tool was doing everything correctly.
The problem happens when doing the first handshake, when it sends the first login request to the camera. A response comes back with the expected status code 200, the expected outer INVALID_NONCE error, and the expected server_nonce + client_nonce compound at the end of the device_confirm value.
But when it tries to check the password, with whether the received device_confirm matches sha256(client_nonce + sha256(password) + server_nonce) + server_nonce + client_nonce, that fails.
Its almost as if the default password has changed from what is included in credentials.py.
The android app must be able to handle it correctly somehow, as I was able to set up the other TC40 that I bought at the same time. However I couldnt find where does the app store the default password.
ZeliardM commented on Jan 5, 2026
@mpeter50 What functions and classes were you looking at in the APK? I can dig in to it tomorrow and check if they've changed the default somewhere.
mpeter50 commented on Jan 5, 2026
I'm not sure I was able to find their real names when I was looking in log strings, but mostly I was looking at these:
I have also checked a lot of external dependencies to try to make sense of whats happening.
I have attached my jadx project with functions in case it helps.
Things I renamed to names not starting with _ are probably their original names.
New names starting with _ are just a description of their utility or an uncertain guess about real name.
New names tarting with _Maybe are less certain even about function.
TP-Link Tapo_3.15.118_APKPure.xapk.jadx.zip
In the meantime I got the idea to check firmware images with binwalk. Couldnt find firmware for TC40, but apparently C500 (unknown which hardware version) is the same. I found an openwrt uci based user database, but trying passwords found in there did not work. Maybe they are not cleartext though.
mpeter50 commented on Jan 5, 2026
To elaborate more, I have found that login starts in com.tplink.libtapocameranetwork.transport.local.LocalSecureSession.e(Account account) ("login" in my renames) and login response handling happens in com.tplink.libtapocameranetwork.transport.local.LocalSecureSession.E(Account account, SecureAccount secureAccount, Response response) ("_handleLoginResponse" in my renames).
All the script is doing seems ok to me by those. But I cannot figure out where does the account password come from before the camera is registered to a tp link account.
ZeliardM commented on Jan 6, 2026
Ok, I think I found the problem, it looks like they've updated the password, by default it is admin without encryption type 3, if it is encryption type 3, it's a different password. I'm going to take a look at everything here and see if I can get an updated PR pushed out and have you test it. Thanks.
ZeliardM commented on Jan 6, 2026
@mpeter50 Ok, can you use the GH CLI and checkout PR#1633 and see if that works for you?
mpeter50 commented on Jan 6, 2026
Yes, and authentication is working now, thanks! kasa discover now runs to end without error and with the details of the discovered device.
There is a -40210 PROTOCOL_FORMAT_ERROR though when get_wireless_scan_info is sent.
But I'll open a new issue for that, because thats a different issue.
I'll also check if I can make a fixture file for this device as it is now.
mpeter50 commented on Jan 6, 2026
If you think so, this issue can be closed as fixed.
ZeliardM commented on Jan 6, 2026
@mpeter50 make a fixture and put it up here. Let's keep it all here since the communication was part of the original issue here.
mpeter50 commented on Jan 6, 2026
Ok, I'll close the new issue and continue here.
mpeter50 commented on Jan 6, 2026
Until I generate the fixture, here is the debug output of the wifi scanning command in case its useful: https://gist.github.com/mpeter50/a551581a02b623c74be3b54706295b6f
But I'll try to make the fixture today.
163 remaining items
ZeliardM commented on Mar 1, 2026
Maybe also try for the ciphertext using the encrypt password with the plain text new password or the new_password_hash
Puxtril commented on Mar 2, 2026
I tried a couple variations but couldn't get it to work. Honestly I don't see a point in debugging local_account further, as it's not used by the Tapo app to configure the device. I think the only accounts worth looking at are admin and third_party. That gets us device authentication and RTSP/ONVIF/NVR capability.
ZeliardM commented on Mar 2, 2026
Okie dokie, lol...I can agree with that. I will remove the change_admin_password process and just have it as update_credentials. I will look at the third_party piece, I'll look through what you've posted in the past and see what I can get pulled together. Then once I have that done, I'll work on the camera.py module for handling the correct stream. Thanks!
ZeliardM commented on Mar 5, 2026
Ok, #1664 should be good now for handling the credentials correctly. If you could pull that and let me know.
Next, I will work on handling the third_party_account and rtsp streaming url handling.
ZeliardM commented on Mar 5, 2026
Everything is good for the time stuff now, correct? time set and time sync now work?
Was there anything else that needed to be worked on here?
default passwords, credential updating, third_party account and rtsp streaming, and time set and sync, right?
ZeliardM commented on Mar 6, 2026
Can you try my branch for the stream url and third_account handling:
https://github.com/ZeliardM/python-kasa/tree/feature/smartcam-camera-urls
paravoid commented on Mar 7, 2026
Worked great for me! The only UX type of feedback that I have is that stream_rtsp_url happily generated an RTSP URL for me, even though I had no third account configured. I knew that RTSP needs this "third account" of course, so it was no problem for me, but for new users that haven't followed this issue this may get confusing. Thanks again!
ZeliardM commented on Mar 7, 2026
@paravoid Ok, great. Thanks and I will get something about that in there.
Puxtril commented on Mar 9, 2026
#1664 works perfectly!
Your branch feature/smartcam-camera-urls also works great! I updated credentials and was able to access the rtsp stream via the url output by stream_rtsp_url. I was also able to update credentials multiple times. As a funny discovery, trying to set the username to rtsp results in an error I've never seen before (I guess rtsp is a blacklisted username):
Setting rtsp as the usernameI want to say, huge thank-you to you @ZeliardM for getting all this added. A lot of functionality has been added to Tapo cameras with your work! My friend is especially happy with his newfound NVR-compatible camera 😁
ZeliardM commented on Mar 9, 2026
Ok, excellent. I'll work on getting all of the smaller nit issues cleaned up for time handling, credential handling, and third_account and stream URLs. The default credentials and Wi-Fi handling have been merged in already.
That should give us a good handling on SmartCam devices now.
Y'all are most welcome, I couldn't do most of it without your troubleshooting, so thank you as well!
oliv3r commented on May 18, 2026
@ZeliardM just curious what the status is of this issue/work. I ran into the exact same issue with the 'TCA41' (e.g. TC40) with the version of python-kasa on pip; using master with the new default password got me beyond the first bit.
Joining wifi did not work however I think (logs below)? But with #1664 i managed to change the password and join the network!
So what can I do to help getting 1644 through?
As for the time change, that is indeed confusing as mentioned by the reviewer. I'd expect for this camera, we'd be able to keep all args (like seconds) optional, and only accept the timezone argument.
wifi join logskasa --debug --host 192.168.191.1 wifi join '<myssid>' Discovering device 192.168.191.1 for 10 seconds DEBUG:kasa.discover:[DISCOVERY] 192.168.191.1 >> {'system': {'get_sysinfo': {}}} DEBUG:kasa.discover:Waiting a total of 10 seconds for responses... DEBUG:kasa.discover:Decrypted encrypt_info for 192.168.191.1: {'connect_ssid': '', 'connect_type': 'wireless', 'device_id': 'REDACTED_F7A2190598F4A733524285D2528A1B9', 'http_port': 443, 'last_alarm_time': '0', 'last_alarm_type': '', 'owner': '', 'sd_status': 'offline'} DEBUG:kasa.device_factory:Using SmartCamDevice for SMART.IPCAMERA DEBUG:kasa.device_factory:Finding protocol for 192.168.191.1 DEBUG:kasa.device_factory:Finding protocol for DeviceFamily.SmartIpCamera DEBUG:kasa.transports.sslaestransport:Created AES transport for 192.168.191.1 DEBUG:kasa.discover:[DISCOVERY] 192.168.191.1 << {'error_code': 0, 'result': {'device_id': 'REDACTED_AB32E4F68D9B9C9F3000A52', 'device_model': 'TCA41', 'device_name': '#MASKED_NAME#', 'device_type': 'SMART.IPCAMERA', 'encrypt_info': {'data': '', 'key': '', 'sym_schm': 'AES'}, 'encrypt_type': ['3'], 'factory_default': True, 'firmware_version': '1.2.2 Build 251105 Rel.58400n', 'hardware_version': '2.0', 'ip': '192.168.191.1', 'isResetWiFi': False, 'is_support_iot_cloud': True, 'mac': '58-04-4F-00-00-00', 'mgt_encrypt_schm': {'is_support_https': True}, 'protocol_version': 1, 'sv': 1}} DEBUG:kasa.device:Initializing 192.168.191.1 of type <class 'kasa.smartcam.smartcamdevice.SmartCamDevice'> DEBUG:kasa.protocols.smartprotocol:192.168.191.1 multi-request-batch-1-of-1 >> '{"method":"multipleRequest","request_time_milis":1779049572545,"terminal_uuid":"t/bcIdXP5kA5+paQ06VZjw==","params":{"requests":[{"method":"getDeviceInfo","params":{"device_info":{"name":["basic_info","info"]}}},{"method":"getAppComponentList","params":{"app_component":{"name":"app_component_list"}}},{"method":"getConnectionType","params":{"network":{"get_connection_type":{}}}}]}}' DEBUG:kasa.transports.sslaestransport:Trying default credentials to 192.168.191.1 DEBUG:kasa.transports.sslaestransport:Sending handshake1... DEBUG:kasa.httpclient:Posting to https://192.168.191.1 DEBUG:kasa.transports.sslaestransport:Device responded with status 200: {'result': {'data': {'code': -40401, 'time': 9, 'max_time': 10, 'encrypt_type': ['3'], 'key': 'MFwwDQYJKoZIhvcNAQEBBQADSwAwDuk6BLIh654nG8w1z+4KFaAIvQKGAoh3vNLHqR2GhB/fOTp3zNcCAwEAAQ==', 'nonce': 'A004DBACF636B1EA', 'device_confirm': '3B388F0EF0FC07CF728AC8E902284F5602B4A004DBACF636B1EA57AC6468951DAACA'}}, 'error_code': -40413} DEBUG:kasa.transports.sslaestransport:Connected to 192.168.191.1 with default username DEBUG:kasa.transports.sslaestransport:Credentials match DEBUG:kasa.transports.sslaestransport:Performing handshake2 ... DEBUG:kasa.httpclient:Posting to https://192.168.191.1 DEBUG:kasa.transports.sslaestransport:Handshake2 complete ... DEBUG:kasa.transports.sslaestransport:Sending secure passthrough from 192.168.191.1 DEBUG:kasa.httpclient:Posting to https://192.168.191.1/stok=(jE.l035T8n2.sg.65AV0.sqlErFVm4v/ds DEBUG:kasa.protocols.smartprotocol:192.168.191.1 multi-request-batch-1-of-1 << {'error_code': 0, 'result': {'responses': [{'error_code': 0, 'method': 'getDeviceInfo', 'result': {'device_info': {'basic_info': {'avatar': 'room', 'barcode': '', 'dev_id': 'REDACTED_F7A2190598F4A733524285D2528A1B9', 'device_alias': '#MASKED_NAME#', 'device_info': 'TCA41 ' '2.0 ' 'IPC', 'device_model': 'TCA41', 'device_name': '#MASKED_NAME#', 'device_type': 'SMART.IPCAMERA', 'features': 3, 'ffs': False, 'has_set_location_info': 0, 'hw_desc': '00000000000000000000000000000000', 'hw_id': 'REDACTED_9666DF10ECF0501C3B95CEB', 'hw_version': '2.0', 'is_cal': True, 'latitude': 0, 'longitude': 0, 'mac': '58-04-4F-00-00-00', 'manufacturer_name': 'TP-Link', 'mobile_access': '0', 'oem_id': 'REDACTED_406AAE988A728E8A0E42254', 'region': 'EU', 'sw_version': '1.2.2 ' 'Build ' '251105 ' 'Rel.58400n'}, 'info': {'cover_reg_num': 4, 'device_model': 'TCA41', 'hw_id': 'REDACTED_9666DF10ECF0501C3B95CEB', 'hw_version': '2.0', 'isp_sw_version': '1.2.2_Build_251105_Rel.58400n', 'isp_version': 1, 'manufacturer_name': 'TP-Link', 'md_reg_num': 32, 'model_description': 'IPC', 'ppd_reg_num': 4, 'roi_reg_num': 1, 'sw_version': '1.2.2 ' 'Build ' '251105 ' 'Rel.58400n'}}}}, {'error_code': 0, 'method': 'getAppComponentList', 'result': {'app_component': {'app_component_list': [{'name': 'sdCard', 'version': 1}, {'name': 'timezone', 'version': 1}, {'name': 'system', 'version': 3}, {'name': 'led', 'version': 1}, {'name': 'playback', 'version': 6}, {'name': 'detection', 'version': 3}, {'name': 'alert', 'version': 2}, {'name': 'firmware', 'version': 2}, {'name': 'account', 'version': 2}, {'name': 'quickSetup', 'version': 1}, {'name': 'ptz', 'version': 1}, {'name': 'video', 'version': 3}, {'name': 'lensMask', 'version': 2}, {'name': 'lightFrequency', 'version': 1}, {'name': 'dayNightMode', 'version': 1}, {'name': 'osd', 'version': 2}, {'name': 'record', 'version': 1}, {'name': 'videoRotation', 'version': 1}, {'name': 'audio', 'version': 3}, {'name': 'nightVisionMode', 'version': 3}, {'name': 'diagnose', 'version': 1}, {'name': 'msgPush', 'version': 3}, {'name': 'deviceShare', 'version': 1}, {'name': 'tamperDetection', 'version': 1}, {'name': 'patrol', 'version': 1}, {'name': 'tapoCare', 'version': 1}, {'name': 'targetTrack', 'version': 1}, {'name': 'blockZone', 'version': 1}, {'name': 'personDetection', 'version': 2}, {'name': 'needSubscriptionServiceList', 'version': 1}, {'name': 'whiteLamp', 'version': 1}, {'name': 'nvmp', 'version': 1}, {'name': 'detectionRegion', 'version': 2}, {'name': 'recordDownload', 'version': 1}, {'name': 'upnpc', 'version': 2}, {'name': 'iotCloud', 'version': 1}, {'name': 'staticIp', 'version': 2}, {'name': 'timeFormat', 'version': 1}, {'name': 'hubManage', 'version': 1}, {'name': 'relayPreConnection', 'version': 1}]}}}, {'error_code': 0, 'method': 'getConnectionType', 'result': {'link_type': 'wifi', 'rssi': '-1', 'rssiValue': 0, 'ssid': ''}}]}} DEBUG:kasa.smart.smartdevice:Querying 192.168.191.1 for modules: Firmware, Led, LensMask, MotionDetection, PanTilt, PersonDetection, TamperDetection, Time DEBUG:kasa.protocols.smartprotocol:192.168.191.1 multi-request-batch-1-of-3 >> '{"method":"multipleRequest","request_time_milis":1779049572926,"terminal_uuid":"t/bcIdXP5kA5+paQ06VZjw==","params":{"requests":[{"method":"getFirmwareUpdateStatus","params":{"cloud_config":{"name":"upgrade_status"}}},{"method":"getFirmwareAutoUpgradeConfig","params":{"auto_upgrade":{"name":"common"}}},{"method":"getLedStatus","params":{"led":{"name":"config"}}},{"method":"getLensMaskConfig","params":{"lens_mask":{"name":"lens_mask_info"}}},{"method":"getDetectionConfig","params":{"motion_detection":{"name":"motion_det"}}}]}}' DEBUG:kasa.transports.sslaestransport:Sending secure passthrough from 192.168.191.1 DEBUG:kasa.httpclient:Posting to https://192.168.191.1/stok=(jE.l035T8n2.sg.65AV0.sqlErFVm4v/ds DEBUG:kasa.protocols.smartprotocol:192.168.191.1 multi-request-batch-1-of-3 << {'error_code': 0, 'result': {'responses': [{'error_code': 0, 'method': 'getFirmwareUpdateStatus', 'result': {'cloud_config': {'upgrade_status': {'lastUpgradingSuccess': True, 'state': 'normal'}}}}, {'error_code': 0, 'method': 'getFirmwareAutoUpgradeConfig', 'result': {'auto_upgrade': {'common': {'enabled': 'on', 'random_range': '120', 'time': '03:00'}}}}, {'error_code': 0, 'method': 'getLedStatus', 'result': {'led': {'config': {'enabled': 'on'}}}}, {'error_code': 0, 'method': 'getLensMaskConfig', 'result': {'lens_mask': {'lens_mask_info': {'enabled': 'on'}}}}, {'error_code': 0, 'method': 'getDetectionConfig', 'result': {'motion_detection': {'motion_det': {'digital_sensitivity': '60', 'enabled': 'on', 'non_vehicle_enabled': 'off', 'people_enabled': 'off', 'sensitivity': 'medium', 'vehicle_enabled': 'off'}}}}]}} DEBUG:kasa.protocols.smartprotocol:192.168.191.1 multi-request-batch-2-of-3 >> '{"method":"multipleRequest","request_time_milis":1779049573045,"terminal_uuid":"t/bcIdXP5kA5+paQ06VZjw==","params":{"requests":[{"method":"getPresetConfig","params":{"preset":{"name":["preset"]}}},{"method":"getPersonDetectionConfig","params":{"people_detection":{"name":"detection"}}},{"method":"getTamperDetectionConfig","params":{"tamper_detection":{"name":"tamper_det"}}},{"method":"getTimezone","params":{"system":{"name":"basic"}}},{"method":"getClockStatus","params":{"system":{"name":"clock_status"}}}]}}' DEBUG:kasa.transports.sslaestransport:Sending secure passthrough from 192.168.191.1 DEBUG:kasa.httpclient:Posting to https://192.168.191.1/stok=(jE.l035T8n2.sg.65AV0.sqlErFVm4v/ds DEBUG:kasa.protocols.smartprotocol:192.168.191.1 multi-request-batch-2-of-3 << {'error_code': 0, 'result': {'responses': [{'error_code': 0, 'method': 'getPresetConfig', 'result': {'preset': {'preset': {'id': [], 'name': [], 'position_pan': [], 'position_tilt': [], 'position_zoom': [], 'read_only': []}}}}, {'error_code': 0, 'method': 'getPersonDetectionConfig', 'result': {'people_detection': {'detection': {'enabled': 'on', 'sensitivity': '60'}}}}, {'error_code': 0, 'method': 'getTamperDetectionConfig', 'result': {'tamper_detection': {'tamper_det': {'digital_sensitivity': '50', 'enabled': 'off', 'sensitivity': 'medium'}}}}, {'error_code': 0, 'method': 'getTimezone', 'result': {'system': {'basic': {'timezone': 'UTC-00:00', 'timing_mode': 'ntp', 'zone_id': 'Europe/Amsterdam'}}}}, {'error_code': 0, 'method': 'getClockStatus', 'result': {'system': {'clock_status': {'local_time': '2025-11-05 ' '16:18:14', 'seconds_from_1970': 1762359494}}}}]}} DEBUG:kasa.smart.smartdevice:Update completed 192.168.191.1: ['getDeviceInfo', 'getAppComponentList', 'getConnectionType', 'getFirmwareUpdateStatus', 'getFirmwareAutoUpgradeConfig', 'getLedStatus', 'getLensMaskConfig', 'getDetectionConfig', 'getPresetConfig', 'getPersonDetectionConfig', 'getTamperDetectionConfig', 'getTimezone', 'getClockStatus'] Password: Asking the device to connect to <myssid>.. DEBUG:kasa.smartcam.smartcamdevice:Querying networks DEBUG:kasa.protocols.smartprotocol:192.168.191.1 multi-request-batch-1-of-1 >> '{"method":"multipleRequest","request_time_milis":1779049574408,"terminal_uuid":"t/bcIdXP5kA5+paQ06VZjw==","params":{"requests":[]}}' DEBUG:kasa.transports.sslaestransport:Sending secure passthrough from 192.168.191.1 DEBUG:kasa.httpclient:Posting to https://192.168.191.1/stok=(jE.l035T8n2.sg.65AV0.sqlErFVm4v/ds DEBUG:kasa.protocols.smartprotocol:192.168.191.1 multi-request-batch-1-of-1 << {'error_code': 0, 'result': {'responses': []}} DEBUG:kasa.transports.sslaestransport:Sending secure passthrough from 192.168.191.1 DEBUG:kasa.httpclient:Posting to https://192.168.191.1/stok=(jE.l035T8n2.sg.65AV0.sqlErFVm4v/ds DEBUG:kasa.protocols.smartprotocol:192.168.191.1 multi-request-batch-1-of-1 >> '{"method":"multipleRequest","request_time_milis":1779049577558,"terminal_uuid":"t/bcIdXP5kA5+paQ06VZjw==","params":{"requests":[]}}' DEBUG:kasa.transports.sslaestransport:Sending secure passthrough from 192.168.191.1 DEBUG:kasa.httpclient:Posting to https://192.168.191.1/stok=(jE.l035T8n2.sg.65AV0.sqlErFVm4v/ds DEBUG:kasa.protocols.smartprotocol:192.168.191.1 multi-request-batch-1-of-1 << {'error_code': 0, 'result': {'responses': []}} DEBUG:kasa.transports.sslaestransport:Sending secure passthrough from 192.168.191.1 DEBUG:kasa.httpclient:Posting to https://192.168.191.1/stok=(jE.l035T8n2.sg.65AV0.sqlErFVm4v/ds DEBUG:kasa.protocols.smartprotocol:Unable to query the device: 192.168.191.1, not retrying: Error sending secure_passthrough message: 192.168.191.1: INVALID_ARGUMENTS(-40209) (error_code=INVALID_ARGUMENTS) Raised error: Error sending secure_passthrough message: 192.168.191.1: INVALID_ARGUMENTS(-40209) (error_code=INVALID_ARGUMENTS) Traceback (most recent call last): File "/usr/local/bin/kasa", line 6, in <module> sys.exit(cli()) ~~~^^ File "/src/kasa/cli/common.py", line 282, in __call__ asyncio.run(self.main(*args, **kwargs)) ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.14/asyncio/runners.py", line 204, in run return runner.run(main) ~~~~~~~~~~^^^^^^ File "/usr/local/lib/python3.14/asyncio/runners.py", line 127, in run return self._loop.run_until_complete(task) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ File "/usr/local/lib/python3.14/asyncio/base_events.py", line 719, in run_until_complete return future.result() ~~~~~~~~~~~~~^^ File "/usr/local/lib/python3.14/site-packages/asyncclick/core.py", line 1443, in main rv = await self.invoke(ctx) ^^^^^^^^^^^^^^^^^^^^^^ File "/src/kasa/cli/common.py", line 270, in invoke _handle_exception(self._debug, exc) ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^ File "/src/kasa/cli/common.py", line 268, in invoke return await super().invoke(ctx) ^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.14/site-packages/asyncclick/core.py", line 1956, in invoke return await _process_result(await sub_ctx.command.invoke(sub_ctx)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.14/site-packages/asyncclick/core.py", line 1956, in invoke return await _process_result(await sub_ctx.command.invoke(sub_ctx)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.14/site-packages/asyncclick/core.py", line 1306, in invoke return await ctx.invoke(self.callback, **ctx.params) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.14/site-packages/asyncclick/core.py", line 873, in invoke rv = await rv ^^^^^^^^ File "/usr/local/lib/python3.14/site-packages/asyncclick/core.py", line 873, in invoke rv = await rv ^^^^^^^^ File "/src/kasa/cli/wifi.py", line 49, in join res = await dev.wifi_join(ssid, password, keytype=keytype) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/src/kasa/smartcam/smartcamdevice.py", line 385, in wifi_join return await self.protocol.query({"connectAp": payload}, retry_count=0) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/src/kasa/protocols/smartprotocol.py", line 136, in query return await self._query(request, retry_count) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/src/kasa/protocols/smartprotocol.py", line 197, in _query raise ex File "/src/kasa/protocols/smartprotocol.py", line 141, in _query return await self._execute_query( ^^^^^^^^^^^^^^^^^^^^^^^^^^ request, retry_count=retry, iterate_list_pages=True ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ) ^ File "/src/kasa/protocols/smartcamprotocol.py", line 153, in _execute_query return await self._execute_multiple_query( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ request, retry_count, iterate_list_pages ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ) ^ File "/src/kasa/protocols/smartprotocol.py", line 310, in _execute_multiple_query resp = await self._transport.send( ^^^^^^^^^^^^^^^^^^^^^^^^^^^ self.get_smart_request(method, params) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ) ^ File "/src/kasa/transports/sslaestransport.py", line 658, in send return await self.send_secure_passthrough(request) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/src/kasa/transports/sslaestransport.py", line 282, in send_secure_passthrough self._handle_response_error_code( ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^ resp_dict, "Error sending secure_passthrough message" ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ) ^ File "/src/kasa/transports/sslaestransport.py", line 201, in _handle_response_error_code raise DeviceError(msg, error_code=error_code) kasa.exceptions.DeviceError: Error sending secure_passthrough message: 192.168.191.1: INVALID_ARGUMENTS(-40209) (error_code=INVALID_ARGUMENTS)Scanning for networks worked though,
Wifi scan resultsweird that everything is 'None' though? maybe that's why it's failing? I don't have the app nor a cloud account, these are fresh out of the box, though I did do a factory reset at some point when trying out things.
Also my network is configured as WPA2/WPA3 in OpenWRT, though I saw WPA3 talks in this thread earlier.
And as mentioned as well, --username is mandatory, content is irrelevant.
On a nother note, i just ran an nmap on the camera; and no ONVIF or RTSP ports where enabled/available, which could be related to this '3rd account' thing you guys where talking about? If someone has enabled this third account option, maybe they can run nmap and see if those ports now become available? here's what I ran ...
docker run --rm --net=host instrumentisto/nmap -p 1-2000 -sS -sV -O -T3 -v --min-rate 500 <camera_ip>
Also, on the streams_url patch, there's the update third party credentials, and the genreate rtsp stream url; but there's more stream variants, tapo, rtsp and onvif, and afaik they all require the password encrypted/hashed, right? so should we not generate all 3 in one go? so that users who want to use the tapo stream without enabling the rtsp/onvi stuff still get a properly generated URL? Just a thought ...
However; i played with these commands from the patch (not the branch, so maybe i need more patches ;p) but the generate url just repeats what i input (e.g. asks for username/password) so what is the purpose if nothing is being encrypted hashed?
And sadly, the updating of the credentials did not work for me (using master + the #1664 patch and the initial attempt patch or the brach as is)
third party failUsername: camuser Password: somerandompassword DEBUG:kasa.protocols.smartprotocol:192.168.1.48 multi-request-batch-1-of-1 >> '{"method":"multipleRequest","request_time_milis":1779171557837,"terminal_uuid":"WMWpVBIyPkBt0OmyTi1W3Q==","params":{"requests":[{"method":"getThirdAccount","params":{"user_management":{"name":"third_account"}}}]}}' DEBUG:kasa.transports.sslaestransport:Sending secure passthrough from 192.168.1.48 DEBUG:kasa.httpclient:Posting to https://192.168.1.48/stok=GEw04wbRQ4bVJ8CDObhWa!jF5sHH0IRH/ds DEBUG:kasa.protocols.smartprotocol:192.168.1.48 multi-request-batch-1-of-1 << {'error_code': 0, 'result': {'responses': [{'error_code': 0, 'method': 'getThirdAccount', 'result': {'user_management': {'third_account': {'ciphertext': '', 'enabled': 'on', 'public_key': '-----BEGIN ' 'PUBLIC ' 'KEY-----\n' 'MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDGUig9lgY2iXrEWMyClA1VGlOT\n' 'xmaYqKjFKF/VH2MxqEidhyw+M3t8WMR8EnLf0W13yooVZyXy/35f1H0QgsJE1YWC\n' '3pX5jfQQeklGUgefscqq2ke/kei1On8IUBaW9hQPCkgYWNtyIZMV5w71fsSgJVGm\n' '03m3L7zNObXlNqNO6QIDAQAB\n' '-----END ' 'PUBLIC ' 'KEY-----\n', 'username': ''}}}}]}} DEBUG:kasa.protocols.smartprotocol:192.168.1.48 multi-request-batch-1-of-1 >> '{"method":"multipleRequest","request_time_milis":1779171557980,"terminal_uuid":"WMWpVBIyPkBt0OmyTi1W3Q==","params":{"requests":[{"method":"getThirdAccount","params":{"user_management":{"name":"third_account"}}}]}}' DEBUG:kasa.transports.sslaestransport:Sending secure passthrough from 192.168.1.48 DEBUG:kasa.httpclient:Posting to https://192.168.1.48/stok=GEw04wbRQ4bVJ8CDObhWa!jF5sHH0IRH/ds DEBUG:kasa.protocols.smartprotocol:192.168.1.48 multi-request-batch-1-of-1 << {'error_code': 0, 'result': {'responses': [{'error_code': 0, 'method': 'getThirdAccount', 'result': {'user_management': {'third_account': {'ciphertext': '', 'enabled': 'on', 'public_key': '-----BEGIN ' 'PUBLIC ' 'KEY-----\n' 'MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDGUig9lgY2iXrEWMyClA1VGlOT\n' 'xmaYqKjFKF/VH2MxqEidhyw+M3t8WMR8EnLf0W13yooVZyXy/35f1H0QgsJE1YWC\n' '3pX5jfQQeklGUgefscqq2ke/kei1On8IUBaW9hQPCkgYWNtyIZMV5w71fsSgJVGm\n' '03m3L7zNObXlNqNO6QIDAQAB\n' '-----END ' 'PUBLIC ' 'KEY-----\n', 'username': ''}}}}]}} Raised error: Incorrect padding Traceback (most recent call last): File "/usr/local/bin/kasa", line 6, in <module> sys.exit(cli()) ~~~^^ File "/src/kasa/cli/common.py", line 282, in __call__ asyncio.run(self.main(*args, **kwargs)) ~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.14/asyncio/runners.py", line 204, in run return runner.run(main) ~~~~~~~~~~^^^^^^ File "/usr/local/lib/python3.14/asyncio/runners.py", line 127, in run return self._loop.run_until_complete(task) ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^^^^^^ File "/usr/local/lib/python3.14/asyncio/base_events.py", line 719, in run_until_complete return future.result() ~~~~~~~~~~~~~^^ File "/usr/local/lib/python3.14/site-packages/asyncclick/core.py", line 1443, in main rv = await self.invoke(ctx) ^^^^^^^^^^^^^^^^^^^^^^ File "/src/kasa/cli/common.py", line 270, in invoke _handle_exception(self._debug, exc) ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^ File "/src/kasa/cli/common.py", line 268, in invoke return await super().invoke(ctx) ^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.14/site-packages/asyncclick/core.py", line 1956, in invoke return await _process_result(await sub_ctx.command.invoke(sub_ctx)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.14/site-packages/asyncclick/core.py", line 1956, in invoke return await _process_result(await sub_ctx.command.invoke(sub_ctx)) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.14/site-packages/asyncclick/core.py", line 1306, in invoke return await ctx.invoke(self.callback, **ctx.params) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.14/site-packages/asyncclick/core.py", line 873, in invoke rv = await rv ^^^^^^^^ File "/src/kasa/cli/common.py", line 161, in wrapper return await ctx.invoke(wrapped_function, dev, *args, **kwargs) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/local/lib/python3.14/site-packages/asyncclick/core.py", line 873, in invoke rv = await rv ^^^^^^^^ File "/src/kasa/cli/camera.py", line 51, in update_third_account_credentials result = await camera_module.update_third_account_credentials(username, password) ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/src/kasa/smartcam/modules/camera.py", line 297, in update_third_account_credentials await self._change_third_account(username, password, public_key_b64) File "/src/kasa/smartcam/modules/camera.py", line 259, in _change_third_account payload = self._build_third_account_auth_payload( section="change_third_account", ...<2 lines>... public_key_b64=public_key_b64, ) File "/src/kasa/smartcam/modules/camera.py", line 80, in _build_third_account_auth_payload "ciphertext": self._encrypt_password(password, public_key_b64), ~~~~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/src/kasa/smartcam/modules/camera.py", line 59, in _encrypt_password key_bytes = base64.b64decode(key_b64) File "/usr/local/lib/python3.14/base64.py", line 85, in b64decode return binascii.a2b_base64(s, strict_mode=validate) ~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^ binascii.Error: Incorrect paddingSo claude fixed the issue for me
diffafter which i could change the password. and running a portscan showed port 554 as open!
Still many questions (image is b/w right now, box says color night mode, the room was dimly lit. there's white leds, but can't enable those, the 'led' just enables the center 'orange' led. Anyway, not relavant, at least for the TCA41 with the patches/work mentioned in this post I got it working!
One snag I hit, i'll verify it with a factory reset; is that i tried to change the 3rd party password; 'verification' worked, so i assumed the password was changed, but i got an authentication error on the original password in HA; logical, but the new password wasn't accepted, nor the old one. So something is amiss, though might be the same issue @mpeter50 ran into before.
I let opencode loose on the APK and it found some probably useful things; I haven't tested/used or done anything with it yet, but there's some useful ideas for sure. https://github.com/oliv3r/python-kasa/tree/features I do have a second camera, so when i have a bit of time; i'll give it a shot; hopeing somebody else did the work meanwhile though ;)
github-actions commented on Aug 21, 2026
There hasn't been any activity on this issue recently. This issue has been automatically marked as stale because of that. It will be closed if no further activity occurs.
Please make sure to update to the latest python-kasa version and check if that solves the issue.
Thank you for your contributions.
paravoid commented on Aug 29, 2026
@ZeliardM I don't think your changes here ever made it to master, right? That's a pity, I had great success with them.
Any chance this could be reopened/revived? Thanks all!