faithraven

Indeed! I don't maintain a Home Assistant integration myself, but anyone who does can leverage this library, and anyone who wants to start a new one is welcome to.

Sorry to disappoint, but I did. Multiple times, across multiple days.

And plugs. Don't forget the plugs! Everyone loves their smart plugs :)

That XOR protocol is a different one, and older than anything in the article. It is the original TP-Link Smart Home protocol used by the Kasa line (HS100, HS110 and similar): JSON on port 9999, obfuscated with an XOR autokey cipher, with no authentication at all.

Tapo devices never spoke it. Their original protocol was an AES passthrough over HTTP, KLAP replaced that in 2023, and TPAP is the newest. As far as I know, newer Kasa hardware and firmware moved to KLAP as well, which would explain why your access method stopped working on the newer ones. My library only covers Tapo devices; for Kasa, python-kasa is the one to look at.

On the cloud: the devices do have to be set up through the phone app with a TP-Link cloud account. Once set up, though, most functions of most devices can be used locally through the library, with neither the devices nor the library having internet access. The main catch is credentials: if you change the account password, for example, the devices need to be online for a little while to pick up the new one.

Without admitting to anything, I was surprised by how little time it took to add support for the new protocol to the library. And I didn't even need an MCP server.

I did my best with the writing, but it clearly didn't land for the two of you. Could you point to one thing, or one pattern, that bothered you most? That would help me improve it.

Author here. tapo is an unofficial Rust client library for TP-Link Tapo devices (plugs, lights, hubs, cameras), with a Python wrapper built on the same crate. It is not affiliated with TP-Link.

The short version: since late 2025, firmware updates have made Tapo devices refuse third-party clients unless you turn on a "Third-Party Compatibility" switch in the Tapo app. The switch works by bringing back the older login, KLAP. With it off, devices speak an undocumented protocol called TPAP, which logs in with SPAKE2+ (RFC 9383). The library now speaks TPAP, so the switch can stay off.

The part I found most interesting is the security difference. A recorded KLAP login can be used to test password guesses offline. With SPAKE2+ it can't, and learning the password later doesn't decrypt sessions captured earlier. So the "compatibility" switch is really a security downgrade, and TP-Link's own FAQ says enabling it "may reduce the security of your devices".

Not everything works with the switch off yet: some cameras, such as a C210 on firmware 1.5.2, still need it on.

Happy to answer questions about the protocol work or the library.

That's a great shout. With more than one ignore file in play, this command is gold.

I'd wager a small sum that git is the tool most of us learned by accident, some of them fortunate, some less so. Thankfully, this one was the former.

Until Claude suggested .git/info/exclude, it never crossed my mind to question how ignoring worked. A search would have answered it in seconds, but you have to think to ask first. I didn't, and I suspect most people don't either. Especially with git, which nearly everyone learns by doing; very few of us ever sit down and learn it properly. That's why I wrote it up: so a few more people can learn this the way we learn everything else in git, by accident.

Now that you mention it, I should add a link to those docs in the article. Thanks!