core: Neato/Vorwerk Integration fails with "Invalid Credentials"

Hope it is okay to link this here but I think a lot of people might find this here:

https://community.home-assistant.io/t/creation-of-vorwerk-kobold-component/253166

Upvote this for new Vorwerk Integration.

I have been playing around with fiddler to see how the app authenticates and get the credentials.

The app makes a POST call to https://mykobold.eu.auth0.com/passwordless/start with a body that contains {"client_id":"xxxxxx","email":"xx@xx.xx","connection":"email","send":"code"}

This will make the server send the user a code to the email used.

When that code is entered the app makes another POST to https://mykobold.eu.auth0.com/oauth/token with body {"source":"vorwerk_auth0_international","audience":"https:\/\/mykobold.eu.auth0.com\/userinfo","grant_type":"http:\/\/auth0.com\/oauth\/grant-type\/passwordless\/otp","scope":"openid email profile read:current_user","client_id":"xxx","otp":"CODE RECIVED IN MAIL","country_code":"XX","locale":"xx","username":"xx@xx.xx","prompt":"login","realm":"email","platform":"ios"}

This will return a token that is used for.

https://beehive.ksecosys.com/ and https://nucleo.ksecosys.com:4443/vendors/vorwerk/robots/

I have a Vorwerk vacuum! Unfortunately don’t know how to code! It’s sad to loose the integration since I have several automations running on it…😤

Update: The current implementation of pybotvac works so far for Neato and Vorwerk. Furthermore the old authentication via username and password is still possible next to modern OAuth2 (neato) and Passwordless Auth (vorwerk) mechanics. All these features will be available within on of the next releases of pybotvac.

I can’t keep working on this issue because I don’t know enough about the Auth-Flows of HA and I don’t have a Vorwerk robot to do tests. But I offer every possible help for someone who wants to jump in. Since pybotvac works so far with both vendors, it’s only the HA integration that is missing.

I’ve talked to Balloob on Discord. We came to the conclusion that it would be easier to separate Neato and Vorwerk in the future. As a result, Vorwerk would get its own integration to support its own config_flow. A good starting point for a developer would be this documentation: https://developers.home-assistant.io/docs/creating_component_index Furthermore, the Neato integration will no longer support Vorwerk robots in the future (since this is broken anyways). This is necessary so that we can use the new OAuth2 mechanics for Neato robots.

It’s kind of hard for me to work on it because I don’t have a Vorwerk bot. If someone else wants to help, don’t hesitate.

Things to know:

• I couldn’t find any python lib that supports the passwordless flow out of the box
• The flow is documented here: https://auth0.com/docs/connections/passwordless/guides/email-otp
• OIDC Discovery Endpoint: https://mykobold.eu.auth0.com/.well-known/openid-configuration
• For the moment I hope that everything else works as usual

Things to do:

1. Extend the existing PR with the passwordless flow https://github.com/stianaske/pybotvac/pull/59 (finished and successfully tested)
2. Find a way to combine the different flows of neato and vorwerk (maybe finished)
3. Find a way to outsource token fetching to HA without breaking pybotvac for non-HA users https://developers.home-assistant.io/docs/api_lib_auth/#sync-example-1

The current situation is as follows:

• As far as we now, there is are no credentials for the new kobold accounts. The app gets authenticated via a code that is sent by mail. I don’t know the exact process behind this.
• Therefore there is no option to obtain OAuth credentials (client_id and client_secret) as well. We can’t log into a Webservice to create them and Neatos client_id and client_secret do not work with Vorwerk.
• Even if vorwerk still uses beehive/nucleo servers (which can be used with pybotvac), there is no known way to authenticate against them.
• I wrote an email to vorwerk support a week ago, but have not received an answer yet.

Tbh, I do not know how to proceed here without further knowledge or documentation.