Nobody should have to find a password in an address bar
Reports and controls what is playing on a Plex Media Server — with a sign-in that never sees your password, and identity that survives the pause button.
Available now in the HomeSeer plugin store.
A media server knows more about the state of a house than almost anything else in it. Somebody is watching something, in a particular room, and it is either paused or it is not. Once that is a device in HomeSeer, a great many obvious automations write themselves.
Signing in without handling a password
The documented way to get a Plex token is genuinely this: sign in to Plex Web, open any item, choose Get Info, click View XML, look at the address bar, and copy a twenty-character token out of a two-hundred-character URL into a field that displays dots.
That is five steps of following instructions and one excellent opportunity to get it subtly wrong.
So the plugin does what Plex's own television apps do, for the same reason — there is no
comfortable way to type a password on a TV either. It asks plex.tv for a PIN, gets back a
four-character code, you type that at plex.tv/link on whatever device is already in
your hand, and the token arrives.
The part I care about: the request carries only a product name and a client identifier. The password is typed at plex.tv, into Plex's own page, and never passes through this plugin at all. That is a better reason to prefer it than the convenience.
A token is often not even needed — Plex permits unauthenticated access from the local network by default, and answers the sessions endpoint with no token whatsoever. The field exists for installs that have turned that off.
Identity, and the pause button
This one is easy to get wrong in a way that only shows up in use.
A Plex session is not durable. Every pause and resume can mint a new session key. Key your HomeSeer devices on that, and every single press of the pause button creates a brand new device — a device list that grows without limit and events that stop firing because they were written against a session that no longer exists.
Identity is therefore the player's machine identifier: the durable thing a person would recognise as "the Kitchen Roku". Sessions come and go beneath it.
Discovery, and the same trap as Roku
Plex has its own discovery protocol, GDM, which broadcasts on UDP 32414. It costs one packet and finds everything — provided the replies are allowed back in.
They are inbound UDP to an unknown executable, which Windows Firewall drops by default, and a dropped reply looks precisely like an empty network. GDM was verified enabled on the server here while replies still never arrived, which is why the outbound subnet probe is not optional and not a nicety.
Exactly the trap the Roku plugin hit with SSDP. Diagnosed the same way, fixed the same way.
One skill, three plugins
Plex, Jellyfin and Emby are three plugins with the same shape, and there is an Alexa music-skill design that would sit across all three. That raises a structural question worth answering before building rather than after: one skill serving three plugins means one deployment, one set of credentials, and three things that can break it.
The design note is mostly a list of reasons to be careful, written while changing course was still cheap.