The cloud that tells on you every time you sign in
Controls Hubspace devices through the Afero cloud — an undocumented API across three hosts, an OAuth flow with no browser, and a deliberate refusal to store the password.
Not in the HomeSeer store yet — running here daily, and heading for the store as a beta.
Hubspace is the house brand behind a lot of inexpensive smart devices, and it runs on Afero's platform. There is no published API. There is, however, an app — and an app has to talk to something.
Three hosts, one of them hidden behind a header
The work started the same way the Sleep Number one did: capture what the real client actually does and treat that record as the contract.
Three separate hosts turn out to be involved. One for the API, one for semantics and metadata, and a Keycloak instance for authentication whose realm name quietly tells you which retailer commissioned the platform.
The metadata backend is the awkward one. It is reached through the same URL as the main API and selected by the Host header — send the request to the primary host without the override and it returns a flat 404, which reads as "that endpoint does not exist" rather than "you addressed the wrong backend".
Signing in without a browser, and without keeping the password
Afero's login is a standard OAuth2 authorisation-code flow with PKCE against Keycloak, with one inconvenience: the "browser" step has to be performed by the plugin. Fetch the login page, post credentials to the form it names, and read the authorisation code out of a redirect to a custom URI scheme.
Two decisions around that are worth stating.
The password is used once and never stored. Only the resulting refresh token is persisted, and that goes through Windows DPAPI. There is deliberately no password-replay path in the code at all.
Because Afero emails the account owner on every fresh login. A plugin that re-logged in whenever it felt like it would generate a steady trickle of security alerts to its own user — which is both irritating and, worse, trains somebody to ignore exactly the emails they should be reading.
No IP addresses, anywhere
The cloud reports each device's wi-fi MAC address and never its IP. The entire account dump does not contain one.
But the devices are on the same network as HomeSeer, so the host has almost certainly spoken to them — and the machine's own neighbour table can answer locally. It is best-effort by nature: a device quiet long enough to fall out of the table simply has no answer and is shown without one, rather than shown wrongly.
That trick was invented here and has since been reused in the Wemo plugin, where it does the heavy lifting for devices that have changed DHCP lease.