菜单
2026 map of all known Tuya local_key extraction paths — which are portal-free, which require iot.tuya.com, and which are broken. Must re-verify annually.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Pattern for keeping a rolling temperature-trend sample buffer in Hubitat state, computing slope over a configurable window, and classifying rising/falling/steady/unknown.
Implement Tuya Local v3.3 Groovy drivers on Hubitat using rawSocket, AES-128-ECB, queued retries, and defensive frame parsing.
Use Hubitat async HTTP plus a request queue to authenticate with Cognito, cache tokens in state, refresh proactively, and replay a single 401-failed request.
When two agents produce overlapping skills in one session, consolidate by merging unique content into the highest-confidence existing skill.
Never let cached-state dedup bypass session validity in cloud-backed Hubitat drivers.
Standard guard pattern for async HTTP response callbacks in Hubitat drivers
| name | tuya-key-extraction-auth-paths |
| description | 2026 map of all known Tuya local_key extraction paths — which are portal-free, which require iot.tuya.com, and which are broken. Must re-verify annually. |
| domain | protocol |
| confidence | high |
| source | earned — Cypher session 7, 2026-05-17. Sources: make-all/tuya-local cloud.py + const.py, tuya-device-sharing-sdk user.py, tuyapi SETUP.md, localtuya README. |
Use this skill when a user asks how to get the local_key for a Tuya device, or when evaluating whether a Tuya-based Hubitat driver can be built without requiring the user to register at iot.tuya.com.
Every Tuya v3.3+ device encrypts all LAN traffic with AES-128-ECB using a 16-byte local_key. The key is assigned by Tuya's cloud during device provisioning and is NOT broadcast over the LAN. You must retrieve it from Tuya's cloud — the question is which cloud endpoint and what credentials it requires.
| Path | Portal-free? | Works? | Prerequisites |
|---|---|---|---|
make-all/tuya-local cloud-auth | Yes | Yes — but fragile | Home Assistant installed + SmartLife app |
tinytuya wizard | No | Yes | iot.tuya.com developer account (free, 20 min) |
localtuya (HA) cloud config | No | Yes | iot.tuya.com Client ID + Secret + User ID |
tuya-cli link (MITM) | Yes | No — broken | DEPRECATED; Tuya encrypts app traffic |
| Smart Life ADB backup | Yes | No — blocked | allowBackup=false; requires rooted phone |
| BLE provisioning channel | Yes | Not applicable | Local key not transmitted over BLE |
tuyapi consumer API | Yes (in theory) | No working tool | No maintained path in 2026 |
make-all/tuya-local Cloud-AuthPOST https://apigw.iotbing.com/v1.0/m/life/home-assistant/qrcode/tokens?clientid=HA_3y9q4ak7g4ephrvke&usercode={code}&schema=haauthorizeGET /v1.0/m/life/home-assistant/qrcode/tokens/{token}?... until user scans.access_token, refresh_token, endpoint. HA stores as auth cache.local_key per device.local_key stored in HA config entry.client_id = "HA_3y9q4ak7g4ephrvke" is hardcoded in custom_components/tuya_local/const.py. Tuya can revoke it. If that happens, all make-all/tuya-local users lose the cloud-auth path simultaneously.apigw.iotbing.com is the consumer Smart Life API gateway, separate from iot.tuya.com. Changes to that API can break the flow.haauthorize.tinytuya wizardpython -m tinytuya wizard with API Key + Secretdevices.json output contains id, key (local_key), ip per deviceKey is permanent until device is factory-reset or re-paired. Developer portal trial is now 1 month, renewable every 6 months — only affects re-extraction, not usage of an already-extracted key.
tuya-cli MITMExplicitly deprecated in the tuyapi SETUP.md: "This method is deprecated because Tuya-branded apps have started to encrypt their traffic in an effort to prevent MITM attacks like this one." Broken since ~2022.
SmartLife app (com.tuya.smartlife) sets allowBackup=false in its manifest. adb backup is blocked at the OS level. Rooted phone direct filesystem access (/data/data/com.tuya.smartlife/) would expose a SQLite DB, but it is encrypted with SQLCipher; key derivation requires APK reversing. Not practical for users.
Tuya BLE provisioning sends WiFi SSID + password from phone to device. The local_key is a server-side-generated value returned by Tuya cloud during the claim handshake — it is never transmitted over BLE. No BLE-based key extraction exists.
tuyapi consumer APINo maintained reverse-engineered tool authenticates against a1.tuyaus.com or px1.tuyaus.com and returns local_key values. The API surface changes with app updates. MITM (the only previous approach) is broken.
local_keyWhen writing a Hubitat driver README for a Tuya device:
tinytuya wizard as the primary path — it is well-documented, has a step-by-step PDF, and does not depend on HA infrastructure. The iot.tuya.com registration is free and takes ~20 minutes.make-all/tuya-local cloud-auth as an alternative for users who already run HA — faster UX, but note the HA prerequisite explicitly.make-all/tuya-local starts failing cloud-auth (check their GitHub issues)