| name | tplink-ax53 |
| description | Manage TP-Link Archer AX53 (WiFi 6) router via Python API and web UI. Use when the user mentions their router, WiFi settings, WireGuard VPN, DNS, guest network, connected devices, bandwidth, wireless configuration, or anything related to their home network. |
| allowed-tools | Bash, Read, Write, Edit |
TP-Link Archer AX53 Router Management
Model: TP-Link Archer AX53 (V1) — Qualcomm IPQ5018, WiFi 6 (802.11ax)
Admin URL: http://192.168.0.1
API Library: tplinkrouterc6u (Python)
Quick Setup
cd /tmp && mkdir -p tplink-api && cd tplink-api
python3 -m venv .venv && source .venv/bin/activate
pip install tplinkrouterc6u
API Connection Pattern
Always use this pattern. The router only allows one active session — always logout when done.
from tplinkrouterc6u import TplinkRouterProvider
ROUTER_HOST = "http://192.168.0.1"
ROUTER_PASS = "<admin-password>"
router = TplinkRouterProvider.get_client(ROUTER_HOST, ROUTER_PASS)
try:
router.authorize()
finally:
try:
router.logout()
except:
pass
⚠️ If the user gets "already logged in" errors, wait 1-2 minutes for the session to expire, or ask them to close the browser tab with the router UI.
The request() Method — Undocumented API
This is the core method for reading/writing any router setting. The high-level library methods (get_status(), etc.) are limited — request() gives full access.
result = router.request("admin/<section>?form=<form>", "operation=read")
result = router.request("admin/<section>?form=<form>", "operation=write&key=value&key2=value2")
result = router.request("admin/<section>?form=<form>", "operation=read", ignore_errors=True)
API Endpoint Reference
WiFi Settings
r = router.request("admin/wireless?form=wireless_5g", "operation=read")
r = router.request("admin/wireless?form=wireless_2g", "operation=read")
Key fields:
| Field | Example Values | Description |
|---|
ssid | "My Network" | Network name |
psk_key | "MyPassword123" | WiFi password |
encryption | psk, psk_sae, sae, none | WPA2 / WPA2+WPA3 / WPA3 / Open |
channel | "auto", "36", "1" | Channel selection |
current_channel | "36" | Actual channel in use |
htmode | "80", "160", "auto" | Channel width (MHz) |
txpower | "high", "mid", "low" | Transmit power |
hidden | "on", "off" | Hidden SSID |
Change WiFi Password
router.request("admin/wireless?form=wireless_5g", "operation=write&psk_key=NewPassword123")
router.request("admin/wireless?form=wireless_2g", "operation=write&psk_key=NewPassword123")
Always change BOTH bands — they share the same SSID with Smart Connect.
Enable WPA2/WPA3 Mixed Mode
router.request("admin/wireless?form=wireless_5g",
"operation=write&encryption=psk_sae&psk_version=rsn&psk_cipher=aes")
router.request("admin/wireless?form=wireless_2g",
"operation=write&encryption=psk_sae&psk_version=rsn&psk_cipher=aes")
Encryption values:
psk = WPA2 onlypsk_sae = WPA2/WPA3 mixed (recommended for most homes)sae = WPA3 only (breaks many IoT devices)none = Open network
DNS Configuration
router.request("admin/network?form=wan_ipv4_pppoe",
"operation=write&dns_mode=static&static_pridns=1.1.1.1&static_snddns=1.0.0.1")
router.request("admin/network?form=wan_ipv4_pppoe",
"operation=write&dns_mode=dynamic")
r = router.request("admin/network?form=wan_ipv4_pppoe", "operation=read")
For DHCP connections (not PPPoE), use form wan_ipv4_dhcp instead.
WireGuard VPN Server
r = router.request("admin/wireguard?form=config", "operation=read")
⚠️ WireGuard writes return encrypted/non-JSON responses. Manage WireGuard accounts (add peers, export configs) through the web UI only at: Advanced → VPN Server → WireGuard.
Connected Devices
status = router.get_status()
for d in status.devices:
print(f"{d.hostname} — {d.ipaddr} — {d.macaddr} — {d.type} — signal:{d.signal}")
Full Endpoint Table
| Endpoint | R/W | Description |
|---|
admin/wireless?form=wireless_5g | R/W | 5 GHz WiFi settings |
admin/wireless?form=wireless_2g | R/W | 2.4 GHz WiFi settings |
admin/network?form=wan_ipv4_pppoe | R/W | WAN PPPoE settings (IP, DNS, gateway) |
admin/network?form=wan_ipv4_dhcp | R/W | WAN DHCP settings |
admin/wireguard?form=config | R only | WireGuard server status |
admin/status?form=all | R only | Full router status |
admin/firmware?form=upgrade | R only | Firmware version info |
WireGuard VPN — Setup Checklist
When the user wants to set up VPN:
- Check for CGNAT — WAN IP in router must match
whatismyip.com. If not, user needs to call ISP for a real public IP.
- Enable WireGuard — Web UI: Advanced → VPN Server → WireGuard → ✅ Enabled
- Create accounts — One per device. Click ➕ Add, name it (e.g., "iPhone", "MacBook").
- Export configs — Click 🔗 link icon → QR code (phones) or Export (desktop)
- Set up DDNS — TP-Link DDNS is free with a cloud account. Hostname like
my-home.tplinkdns.com.
- Enhance exported config — Add
DNS = 1.1.1.1, 1.0.0.1 to [Interface] and replace IP with DDNS hostname in Endpoint.
Common VPN Issues
| Symptom | Cause | Fix |
|---|
| "Data sent" but no "Data received" | Wrong private key, or testing from home WiFi | Each device needs its OWN config. Never test VPN from the same network as the router. |
ERR_NAME_NOT_RESOLVED | DNS not set in WireGuard config | Add DNS = 1.1.1.1, 1.0.0.1 to [Interface] section |
| IP shows iCloud Private Relay | Apple's private relay intercepting | Disable: Settings → iCloud → Private Relay → Off |
| VPN connects but no internet | AllowedIPs too restrictive | Use AllowedIPs = 0.0.0.0/0, ::/0 for full tunnel |
| Handshake never completes | Port 51820 blocked by ISP | Try changing listen port in router WireGuard settings |
WireGuard Config Template
[Interface]
PrivateKey = <from-router-export>
Address = <from-router-export>/32
DNS = 1.1.1.1, 1.0.0.1
[Peer]
PublicKey = <from-router-export>
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = <ddns-hostname>:51820
PersistentKeepalive = 25
WiFi Best Practices
When the user asks about optimizing WiFi:
| Setting | Recommended | Notes |
|---|
| Smart Connect | On | Auto-steers devices to best band |
| OFDMA | On | WiFi 6 multi-user, no downside |
| TWT | On | Battery saver for phones/tablets |
| Encryption | psk_sae (WPA2/WPA3) | WPA3-only breaks IoT devices |
| DNS | Cloudflare 1.1.1.1 | Faster than ISP defaults |
| 5 GHz channel width | 80 MHz | 160 MHz can be unstable in apartments |
| 2.4 GHz channel width | 20 MHz | More reliable in dense environments |
Guest Network
- Isolated from main network (guests can't see your devices)
- Set up via web UI: Advanced → Wireless → Guest Network
- Bandwidth limit: Advanced → QoS / Bandwidth Control → cap at ~50 Mbps
OpenWrt Compatibility
NOT supported. V1 uses Qualcomm IPQ5018 with no mainline Linux kernel support. V2 has only 256 MB RAM. Don't attempt it.
Probing for New Endpoints
If you need to discover more API endpoints:
sections = ['wireless', 'network', 'firewall', 'nat', 'wireguard',
'openvpn', 'pptp', 'guest_network', 'iot_network', 'qos',
'system', 'status', 'firmware', 'led', 'cloud']
forms = ['config', 'setting', 'status', 'all', 'wireless_2g', 'wireless_5g',
'guest_2g', 'guest_5g', 'wan_ipv4', 'wan_ipv4_pppoe', 'wan_ipv4_dhcp']
for section in sections:
for form in forms:
try:
r = router.request(f"admin/{section}?form={form}",
"operation=read", ignore_errors=True)
if r and 'errorcode' not in str(r).lower():
print(f"✅ admin/{section}?form={form} → {list(r.keys())}")
except:
pass
Useful Reference
