Tapo Library Update: Now Supporting the TPAP Protocol

Imagine your automation script has been flawlessly toggling a Tapo smart plug for months. Suddenly, a silent firmware update occurs, and your next command returns a cold 403 Forbidden error.

The culprit? A hidden setting called "Third-Party Compatibility", located deep within the Tapo app under Me > Third-Party Services. Since the rollout of firmware 1.4.0, devices will only communicate with external clients using legacy methods if this specific toggle is enabled.

This issue has been documented across at least nine different reports, including issues #441, #449, and #473.

---

The Big News: No More Toggles Required

As of version v0.11.1 of tapo (my unofficial client for TP-Link Tapo devices written in Rust and Python), you can leave that compatibility switch off.

This milestone is the result of four months of intensive development, culminating in three rapid-fire releases:

• v0.10.0 (September 28)
• v0.11.0 (October 2)
• v0.11.1 (October 4)

What's New in the Library?

• Full TPAP protocol support.
• Support for a new family of devices (including the H200).
• Implementation of two highly requested Tapo app features.

Note on Implementation: This library is developed in Rust, and the Python package serves as a thin wrapper. Consequently, all updates are synchronized across both languages under the same version number.

// Example: The library automatically negotiates the protocol
let client = TapoClient::new("192.168.1.50", "user", "password").await?;
client.turn_on().await?; 

---

A History of "Silent" Security Shifts

This is the third instance in three years where a security update has effectively locked out third-party developers.

The Timeline of Protocol Evolution

1. The First Breach: In February 2023, researchers from the University of Catania and Royal Holloway, University of London identified four vulnerabilities in the L530E bulb. An attacker within range could potentially hijack a Tapo account and steal Wi-Fi credentials.
2. The KLAP Era: Shortly after, TP-Link quietly replaced the original AES protocol with KLAP. This was done without announcement, leading to widespread confusion in community forums.
3. The Camera Conflict: In November 2023, Juraj Nyíri (maintainer of the Home Assistant Tapo camera integration) reported a bug. After a long delay, TP-Link released the "Third-Party Compatibility" toggle in December 2024 to allow local logins to function again.
4. The TPAP Shift: By October 2025, firmware 1.4.0 introduced TPAP.

TP-Link's official stance on the compatibility switch is as follows:

"is disabled by default to ensure security... switching it on may reduce the security of your devices."

When users complained that their Home Assistant setups broke, they were told that Home Assistant is officially supported not an officially supported platform.

---

Deep Dive: TPAP Support

The "Third-Party Compatibility" switch essentially acts as a protocol selector for hubs, plugs, power strips, and lights.

Because the library now speaks TPAP, it can connect to devices regardless of the switch setting, whether using a direct IP or the discover_devices function. No code changes are required; the client handles the negotiation automatically.

Important Technical Nuances

• Account Lockouts: TPAP is strict. Too many incorrect passwords will trigger a temporary lockout.
  • Wrong Password $\rightarrow$ TPAP_CREDENTIALS
  • Too Many Attempts $\rightarrow$ TPAP_AUTH_ATTEMPTS_LIMIT
• Device Variations:
  • H200 (v0.10): Uses AES SSL regardless of the switch.
  • C220 & C510W (v1.3.4): Support TPAP (works with switch OFF).
  • C210 (v1.5.2): Does not support TPAP; requires AES SSL and thus requires the switch to be ON.
• Cleanup: The original AES protocol (pre-KLAP) was supported removed in v0.11.0 as it is no longer found in modern firmware.

---

Why TPAP is Superior for Security

While bypassing a switch is convenient, TPAP is objectively safer than KLAP.

The KLAP Weakness

KLAP uses a hash-based exchange to prove identity. While the password isn't sent in plain text, the exchange is vulnerable to offline brute-force attacks. If an attacker captures a single login session, they can test millions of password guesses locally: $\text{Hash}(\text{Password} + \text{Random Salt}) \rightarrow \text{Verification}$

The TPAP Strength

TPAP implements SPAKE2+ (as defined in RFC 9383), a Password-Authenticated Key Exchange (PAKE).

In TPAP, there is no data that can be verified offline. An attacker cannot guess passwords using their own hardware; they must attempt a login against the actual device, one attempt at a time, making brute-force attacks practically impossible.