Your script has been switching a Tapo plug on and off for months. Then the plug quietly updates its firmware, and the next request comes back with 403 Forbidden. The cause is a switch called "Third-Party Compatibility", tucked away in the Tapo app under Me > Third-Party Services. Since firmware 1.4.0, a plug only talks to third-party clients the way it used to while that switch is on. It has tripped people up again and again.
As of v0.11.1 of tapo, my unofficial Rust and Python client for TP-Link Tapo devices, the switch can stay off. That's the headline of nearly four months of work, landing in three releases: v0.10.0 on 28 September, v0.11.0 on 2 October and v0.11.1 on 4 October. The library also gained a new family of devices and two features of the Tapo app.
This is the third time in three years a security change has locked third-party clients out of Tapo devices. In 2023, firmware updates swapped the original AES protocol for KLAP after researchers from the University of Catania and Royal Holloway reported flaws. In 2024, cameras stopped accepting logins, and TP-Link shipped the Third-Party Compatibility toggle. In 2025, firmware 1.4.0 brought TPAP and put plugs behind the same switch, off by default.
Source: Hacker News · Summarized by HeadlinesBriefing