Add support for Spa's that connect over the Bestway Spa app (was: Bestway Hermosa support details)

[w8tam]

I own a Bestway Saluspa Hermosa.

https://bestwayusa.com/saluspa-hermosa-energy-efficient-smart-airjet-inflatable-hot-tub-with-app-control-5-7-person-black-marble-60158e

It uses this app for wifi control:
https://play.google.com/store/apps/details?id=com.bestway.smartspa

From what I can tell, this app also uses the Bestway API, but does not work with the existing integration. I did not have to create an account to control my spa. In fact, there is no login option in the app, it seems to create a 16 byte User ID, and use that for authentication.

What is the best way to assist in data capturing data that I might be able to help get this device supported by this HA integration?

I tried controlling it with the Bestway Smart Hub app, but it won't link up.

I'm happy to assist with any data collection or packet capture necessary to get this working.

[bobbyverlaan]

I am in a similar position with the Santorini model. I used Charles Proxy to figure out what requests are sent from the Bestway Spa app to the servers of Bestway. The first request POSTS to the /enduser/visitor endpoint:

:method: POST
:scheme: https
:path: /api/enduser/visitor/
:authority: smarthub-eu.bestwaycorp.com
content-type: application/json; charset=utf-8
appid: AhFLL54HnChhrxcl9ZUJL6NZfolTIB
accept: */*
nonce: M7BS9AIAR0DRHM346QQOKSTS59JAIQEZ
accept-encoding: gzip, deflate, br
accept-language: en
content-length: 279
user-agent: BestWay/159 CFNetwork/3826.500.91 Darwin/24.4.0
ts: 1741522481
sign: 2D1B6C749552EE5A6A8EAE218063B32E

{"visitor_id":"DF871234-9EC4-4937-9EBF-C46885F61234","location":"NL","app_id":"AhFLL54HnChhrxcl9ZUJL6NZfolTIB","lan_code":"en","marketing_notification":0,"registration_id":"9f1db24c1146c7e737f69647fca50xxx9999e46404x1x6x787932186543b3b31","timezone":"GMT+1:00","push_type":"ios"}

The response is:

:status: 200
date: Sun, 09 Mar 2025 12:14:42 GMT
content-type: application/json
content-length: 314
server: nginx/1.25.1
access-control-allow-origin: *
content-security-policy: default-src 'self' *.alicdn.com *.amazonaws.com.cn *.amazonaws.com *.mxchip.com *.infinitus.com.cn *.wezhan.cn unpkg.com  *.aliyuncs.com 'unsafe-inline' 'unsafe-eval' blob: data: ;
x-xss-protection: 1;mode=block
x-content-type-options: nosniff
x-frame-options: DENY
strict-transport-security: max-age=31536000
content-security-policy: frame-ancestors 'self'
access-control-allow-origin: *
access-control-allow-headers: *
access-control-allow-credentials: true
access-control-allow-methods: *

{
    "code": 0,
    "message": "SUCCESS",
    "request_id": "14b89bdcfce011efb6bf0242ac480009",
    "data": {
        "enduser_id": "u_DF87CBCC-9EC3-4937-9EBF-C46885F69626_AhFLL54HnChhrxcl9ZUJL6NZfolTIB",
        "token": "a12x2x7x6244ddd65acf7ab598xxxxxx",
        "lan_code": "en",
        "notify": {}
    }
}

When a call from the Bestway Spa app is sent to this endpoint it uses some extra headers like an app_id, nonce, ts, and sign. When trying in Postman to replicate the same request, I do get a 403 error response with the following JSON:

{
    "code": 403,
    "data": {
        "log_id": "4837e77efce511ef9fb90242ac481234"
    },
    "message": "Missing input parameter required for signature"
}

Probably because the server is checking the validity of the request using these parameters:

• ts: timestamp doesn't match?
• nonce: generated ID already used in previous request?
• sign: already used or not valid?

I don't have any Home Assistant Integration or Python experience, so after some Googling I feel I get stuck here. Anybody has experience and time to help out and work on getting the newer Bestway models supported with this HA integration? Or to move one step closer? Happy to provide input on the calls done.

Ps. I've changed and x'd some of the parameters values in order to not put in the real raw data of the request.

[andrewmichael]

Hi i have also used charles proxy to look @ the app calls, im currently using jadx to look though the code to see if i can identify the calls, happy to colab on this.

Cheers

[bobbyverlaan]

@andrewmichael any luck on the login mechanism?

[TechnoTaff]

Joining the effort!

Device: Lay-Z-Spa Toronto
OS: Android

The /api/enduser/visitor API is broadly the same (obfuscated, so please don't use for cryptographic analysis):

headers

:method: POST
:path: /api/enduser/visitor
:authority: smarthub-eu.bestwaycorp.com
:scheme: https
pushtype: Android
appid: AhFLL54HnChhrxcl9ZUJL6QNfolTIB
nonce: HB5PVneimstROaK108bajKH64Oz4Ld4o
ts: 1746123456
accept-language: en
sign: 9592ADF4dd6617DC0882795d5558C37C
authorization: token abde28a333e082f59ea10e30656b452d
content-type: application/json; charset=UTF-8
content-length: 237
accept-encoding: gzip
user-agent: okhttp/4.9.0

body

{
	"push_type": "android",
	"marketing_notification": "0",
	"timezone": "GMT+08:00",
	"visitor_id": "1234567890123456789",
	"registration_id": "",
	"lan_code": "en",
	"location": "GB",
	"app_id": "AhFLL54HnChhrxcl9ZUJL6QNfolTIB",
	"brand": "Huawei",
	"client_id": ""
}

The visitor_id seems to be a numeric representation on Android, rather than a GUID.

Could the authorization token be encrypted with a random nonce each time? I tried to investigate with jadx but quickly started going round in circles. Some variant of digest authentication?

[TechnoTaff]

I have noticed that the initial login doesn't use "smarthub-eu.bestwaycorp.com".

It connects to "app-api.lay-z-spa.co.uk".

For whatever reason I don't see this traffic in Charles Proxy, can apps bypass proxies?

I can see it in a packet trace, but also I can't see that URL anywhere in the app.

Slightly confused.

[TechnoTaff]

So, the format of sign is:

ts = System.currentTimeMillis() / 1000
nonce = just a random 32-char alpha-numeric
sign = a concatinated string, consisting of:

The 30-char App ID (AhFLL54HnChhrxcl9ZUJL6QNfolTIB) +
The 50-char Digit App Secret (--------------------REDACTED----------------------) +
The nonce string (above) +
ts (also above)

The string is then passed through java.security.MessageDigest with the MD5 Algorithm

I've validated this with Linux using (i've changed from the real values):

$ echo -n "AhFLL54HnChhrxcl9ZUJL6QNfolTIB--------------------REDACTED----------------------01234567890abcdefghij0123456789017467537671234567890" | md5sum
2851f10851294fb61ba754d947d872f1  -

[TechnoTaff]

Some example code to generate the sign string:

import hashlib
import random
import string
import time

def get_random_nonce(n):
    chars = string.ascii_lowercase + string.digits  # 'abcdefghijklmnopqrstuvwxyz0123456789'
    return ''.join(random.choices(chars, k=n))

def md5_of_string(input_string):
    return hashlib.md5(input_string.encode('utf-8')).hexdigest()

NONCE = get_random_nonce(32)
APPID = "AhFLL54HnChhrxcl9ZUJL6QNfolTIB"
APPSECRET = "--------------------REDACTED----------------------"
TS = str(int(time.time()))

STRING_TO_HASH = APPID + APPSECRET + NONCE + TS

print(STRING_TO_HASH)
print(md5_of_string(STRING_TO_HASH).upper())

[bobbyverlaan]

@TechnoTaff did you manage to do a subsequent request and execute a command on your Spa using that generated sign?

[TechnoTaff]

@TechnoTaff did you manage to do a subsequent request and execute a command on your Spa using that generated sign?

I wasn't sure what credentials to use. Do I just replay with the registration_id and visitor_id?

Where does the token come from in the authentication header?

[bobbyverlaan]

I don't know where the visitor_id and registration_id came from. My hypothesis is it got generated when I created my first login in the app and after that connected my Spa over bluetooth.

So there are two hypotheses:

• visitor_id is generated upon app (iOS) install and is static; and
• registration_id is generated when connecting the spa over Bluetooth via the Bestway app and is static.

I didn't log these requests through CharlesProxy upon first install, and didn't try to reinstall again with CharlesProxy yet to inspect the initial requests done and verify the above statements. It's a bummer they don't use normal user/pass login. Would have been way easier. hehe.

by the way. In the requests done for the privacy statement and EULA the following contact mail address is provided: u_martin.zhou@bestwaycorp.com. Don't know if anyone had ever contact with Bestway itself?

[bobbyverlaan]

I think you replay the registration_id and visitor_id indeed. I've used a proxy again on another iOS device and did a fresh app install without any connection to the spa. I got a different registration_id, but got the exact same visitor_id like on my other iOS device.

I received the token in the payload of the POST /api/enduser/visitor endpoint. It's in the data object like so:

{
    "code": 0,
    "message": "SUCCESS",
    "request_id": "37dc73762fe011f0bf0xxxxxac480009",
    "data": {
        "enduser_id": "u_DF87CBCC-9EC3-4937-9EBF-C46885F69626_AhFLL54HnChhrxcl9ZUJL6QNfolTIB",
        "token": "4eae861f5dde976d302c39086bfxxxxx",
        "lan_code": "en",
        "notify": {}
    }
}

After receiving the token, each subsequent request to the API is used with the token in the Authorization header. Together with the nonce, ts and sign headers.

Hope you manage to do a successful request to receive a token and then to send a subsequent command using the token.

[bobbyverlaan]

Additional info by loggin via proxy while binding the spa and sending a subsequent command to the spa:

Binding is done with a POST request to the https://smarthub-eu.bestwaycorp.com/api/device/bind/status/ endpoint.

The mobile app sends the key values pairs:

{
  "mac": "047863Bxxxxx",
  "product_id": "F12D9Q",
  "bind_code": "8cb540082fe011f0bfd20242xxxxxxxx"
}

the response is:

{
    "code": 0,
    "message": "SUCCESS",
    "request_id": "969cbf9c2fe011f0b52f0242ac480009",
    "data": {
        "product_id": "F12D9Q",
        "mac": "047863Bxxxxx",
        "device_id": "d4ac5d76f60511efaff22da1xxxxxxxx",
        "check_product_tub": 1,
        "status": 2
    }
}

When sending a command. E.g. to turn on a filter it looks like this:

POST /api/device/command/

{
  "desired": {
    "state": {
      "desired": {
        "filter_state": 1
      }
    }
  },
  "device_id": "d4ac5d76f60511efaff22da1xxxxxxxx",
  "product_id": "F12D9Q"
}

The reponse is 200 OK with a json object with some info about the response.

[TechnoTaff]

Awesome, thank you for the extra info!

I'll see if I can knock up a proof-of-concept in python.

[bobbyverlaan]

With help from @TechnoTaff I can now request a new token via the /api/enduser/visitor/ endpoint, and then use the generated token in subsequent requests to execute device commands to the spa via the /api/device/command/ end point.

Question now becomes if we can (and should) bypass the mobile app altogether in the integration and let the integration do the binding with the Spa instead. I got the setup working by first binding the Spa through the iOS Bestway Spa app and through proxy app logged the requests to the visitor_id, app_id and device_id.

It seems the app_id is static, but don't know yet where the visitor_id and device_id come from.

[w8tam]

I look away for a minute (or 2) and y'all are killing it getting the details! Thank you to everyone working on this!!