Out of box Tapo TC40: discovery not working, authentication failure on wifi setup #1628
Description
Hi!
I had the misfortune to get a TP-Link Tapo TC40 IP camera, which I intend to use with Frigate through the local RTSP stream.
I wanted to set it up without connecting it to the internet, and registering for any cloud service, and I read in the Home Assistant docs (here) that python-kasa should work for provisioning most TP-Link devices, but something is wrong and I cant even scan for wifi networks with it. I have factory resetted it just in case, but that did not help.
I have installed python-kasa 0.10.2 with pip, on python 3.12.
If I run the discovery command while the laptop is connected to the camera's wifi network, I get 0 results:
$ kasa discover
Discovering devices on 255.255.255.255 for 10 seconds
Found 0 devices
Since my laptop receives the IP address 192.168.191.100 on this network, and the default gateway IP is 192.168.191.1, which I can ping, I tried to run a discovery for this IP range too, without success:
$ kasa --target 192.168.191.255 discover
Discovering devices on 192.168.191.255 for 10 seconds
Found 0 devices
Next I though I'll continue with the next steps in the provisioning instructions, however it seems I cannot start a wifi scan with it either:
$ kasa --host 192.168.191.1 wifi scan
Discovering device 192.168.191.1 for 10 seconds
Raised error: Device response did not match our challenge on ip 192.168.191.1, check that your e-mail and password (both case-sensitive) are correct.
Run with --debug enabled to see stacktrace
ERROR:asyncio:Unclosed client session
client_session: <aiohttp.client.ClientSession object at 0x7f418d2ab5c0>
Detailed output with --debug:
$ kasa --debug --host 192.168.191.1 wifi scan
Discovering device 192.168.191.1 for 10 seconds
DEBUG:kasa.discover:[DISCOVERY] 192.168.191.1 >> {'system': {'get_sysinfo': {}}}
DEBUG:kasa.discover:Waiting a total of 10 seconds for responses...
DEBUG:kasa.discover:Decrypted encrypt_info for 192.168.191.1: {'connect_ssid': '',
'connect_type': 'wireless',
'device_id': 'REDACTED',
'http_port': 443,
'last_alarm_time': '0',
'last_alarm_type': '',
'owner': '',
'sd_status': 'offline'}
DEBUG:kasa.device_factory:Using SmartCamDevice for SMART.IPCAMERA
DEBUG:kasa.device_factory:Finding protocol for 192.168.191.1
DEBUG:kasa.device_factory:Finding protocol for DeviceFamily.SmartIpCamera
DEBUG:kasa.transports.sslaestransport:Created AES transport for 192.168.191.1
DEBUG:kasa.discover:[DISCOVERY] 192.168.191.1 << {'error_code': 0,
'result': {'device_id': 'REDACTED_D164F44270DB784055D1852',
'device_model': 'TC40',
'device_name': '#MASKED_NAME#',
'device_type': 'SMART.IPCAMERA',
'encrypt_info': {'data': '', 'key': '', 'sym_schm': 'AES'},
'encrypt_type': ['3'],
'factory_default': True,
'firmware_version': '1.0.4 Build 240902 Rel.38194n',
'hardware_version': '2.0',
'ip': '192.168.191.1',
'isResetWiFi': False,
'is_support_iot_cloud': True,
'mac': 'REDACTED',
'mgt_encrypt_schm': {'is_support_https': True},
'protocol_version': 1}}
DEBUG:kasa.device:Initializing 192.168.191.1 of type <class 'kasa.smartcam.smartcamdevice.SmartCamDevice'>
DEBUG:kasa.protocols.smartprotocol:192.168.191.1 multi-request-batch-1-of-1 >> '{"method":"multipleRequest","request_time_milis":1767154616677,"terminal_uuid":"b+2BG4NWkAozOFExc2pgwA==","params":{"requests":[{"method":"getDeviceInfo","params":{"device_info":{"name":["basic_info","info"]}}},{"method":"getAppComponentList","params":{"app_component":{"name":"app_component_list"}}},{"method":"getConnectionType","params":{"network":{"get_connection_type":{}}}}]}}'
DEBUG:kasa.transports.sslaestransport:Trying default credentials to 192.168.191.1
DEBUG:kasa.transports.sslaestransport:Sending handshake1...
DEBUG:kasa.httpclient:Posting to https://192.168.191.1
DEBUG:kasa.transports.sslaestransport:Device responded with status 200: {'result': {'data': {'code': -40401, 'time': 7, 'max_time': 10, 'encrypt_type': ['3'], 'key': 'MFwwDQYJKoZIhvcNAQEBBQADSwAwSAJBAKv4a/AHIEzDPyDwLsqC5onkBX+/DPC7D0d/CG/m6kNiHFpjrgqssQmndF9sXQHURBa2lCnDIC5EMNbwXrxcyvsCAwEAAQ==', 'nonce': 'CB97EC007FBA2E01', 'device_confirm': '4C8E85943619F7681B2A78FF7F68B8074237A76618958A2EFA6851B54C785F15CB97EC007FBA2E015EC70B5A8ED8041B'}}, 'error_code': -40413}
DEBUG:kasa.transports.sslaestransport:Connected to 192.168.191.1 with default username
DEBUG:kasa.transports.sslaestransport:Device response did not match our challenge on ip 192.168.191.1, check that your e-mail and password (both case-sensitive) are correct.
DEBUG:kasa.protocols.smartprotocol:Unable to authenticate with 192.168.191.1, not retrying: Device response did not match our challenge on ip 192.168.191.1, check that your e-mail and password (both case-sensitive) are correct.
Raised error: Device response did not match our challenge on ip 192.168.191.1, check that your e-mail and password (both case-sensitive) are correct.
I have read warnings that the offline provisioning only works if it has never been set up with a cloud account before, but as far as I know this should be a brand new device. I got it in its original box, nicely wrapped in all the wrapping material.
I have seen #1590 and #1604 which seem to be somewhat related, could it be because it uses newer communication protocols? Though in my case encrypt_type is not TPAP or KLAP, but [3].