HS300 HW v2.0 — KLAP auth fails during CLI onboarding, can't connect without Kasa app
I'm trying to onboard a brand new TP-Link Kasa HS300 (US) smart power strip via CLI without using the Kasa mobile app. The device is Hardware Version 2.0 and uses the KLAP encryption
protocol.
What I've done:
- Factory reset the HS300 (held button 10+ seconds, Wi-Fi LED blinking amber/green)
- Connected my Mac to the device's AP (TP-LINK_Power Strip_XXXX)
- Confirmed IP is 192.168.0.100, device at 192.168.0.1 is pingable
- Port 80 is open, port 9999 is closed (so legacy protocol doesn't work)
Discovery works fine via python-kasa:
Device Type: IOT.SMARTPLUGSWITCH
Device Model: HS300(US)
HW Ver: 2.0
Factory Default: True
Encrypt Type: KLAP
Login version: 2
Owner: (empty)
The problem: Authentication always fails when I try to connect:
kasa --host 192.168.0.1 --username 'myemail mail dot com' --password 'mypassword'
AuthenticationError: Device response did not match our challenge on ip 192.168.0.1,
check that your e-mail and password (both case-sensitive) are correct.
I've confirmed my TP-Link cloud account credentials are correct (can log into kasasmart.com). The device is factory default with no owner.
I also tried the legacy Python-KasaSmartPowerStrip library (port 9999 direct socket) but HW v2.0 doesn't listen on that port at all.
My goal: Onboard this HS300 to my Wi-Fi network and control individual outlets, all from the command line — no Kasa app, no phone.
My setup:
- macOS (Apple Silicon)
- Python 3.14
- python-kasa (latest via pipx)
- HS300(US) HW v2.0, firmware unknown (can't query it)
Questions:
1. Has anyone successfully onboarded an HS300 HW v2.0 via CLI with KLAP?
2. Is there a way to authenticate with a factory-default KLAP device without a TP-Link cloud account?
3. Could there be a python-kasa version compatibility issue with KLAP v2 + login version 2?
4. Any alternative tools or approaches for onboarding KLAP devices from the command line?
Any help appreciated. Happy to share debug logs.
