Tesla Fleet API enrolment

[RichieB2B]

This is a continued discussion from #546

Here is a nice tutorial that can be used to register TWCManager as a personal app with Tesla: https://shankar-k.medium.com/tesla-developer-api-guide-account-setup-app-creation-registration-and-third-party-da24aba1bddd

@ChutneyMary Are you still having issue getting your app registered? At which step do you get stuck following the above guide?

[danielsan1]

Thanks for the link! Beginner question: The requirements for the guide are a domain name and a webserver running on my TWCManager Raspberry Pi, right? (or any other machine?)

[RichieB2B]

Any other machine is fine. It is just used for hosting the certificate of your app and for the callbacks after your app has been added to a car.

[MikeBishop]

As an additional resource, this repo aims to simplify what needs to be hosted on that web server into a Docker container. Still need the domain, however.

[ChutneyMary]

@RichieB2B - I get stuck at the app registration step with a message 'Unable to fulfill request. Please try again later'.

The specific step is after my domain name is entered (including callback URL), then the API Scopes are checked as required. The next button results in the message above.

I did have some progresss when an option was provided - 1. Machine to Machine or 2. 'Authorization Code and Machine-to-Machine'.

The first option 'Machine to Machine' provides a Client ID and Client Secret. But no option to provide my Domain details.

I have the com.tesla.3p.public-key.pem available for retrieval on my public facing domain address. But it's doing nothing without the proper app registration success.

[RichieB2B]

I had the same kind of issue. When I checked the logs of my website I noticed that the page /.well-known/appspecific/com.tesla.3p.public-key.pem could not be retrieved. This caused the app registration to fail. After I fixed this page I was able to finish the registration.

[ChutneyMary]

I'm testing it on my phone with wifi turned off and connected to the mobile network. I navigate to -
https://myhostname.ddns.net/.well-known/appspecific/com.tesla.3p.public-key.pem
The certificate downloads fine.
I've tried a different free domain through noip.com without success. I'm beginning to wonder whether it's the domain ddns.net that's the issue. Can anyone suggest working free domains that Tesla accepts?
I've tried a dozen different app names and app descriptions to ensure I'm not treading on someone else. Tesla is not exactly helpful when it comes to addressing issues like this...

[RichieB2B]

Tesla registers the apps on the domain level, not FQDN. So in your example "ddns.net" which is a dynamic DNS provider. Even if Tesla would allow this (they probably blacklisted it) the chance is someone else already registered an app using "ddns.net". You need to use a domain you actually own.

[ChutneyMary]

Thanks. My understanding of what 'owning' the domain means was deficient. That explanation helps.
Now I just need to decide whether I'm happy to fork out money for a hosting service to retrieve my own data for my own vehicle....grrrr.
And this is before Tesla even starts charging for the Fleet API usage.
Hopefully someone can get the Bluetooth integration working so TWCManager can be a truly off-line system (wishes he studied coding in school).

[MikeBishop]

In order to use the Bluetooth integration, you have to have registered on the portal, so all of these roadblocks are still there. The key that Tesla is fetching from that URL is used to authenticate Bluetooth commands, IIUC.

[ChutneyMary]

I interpret that differently based on what I read in the Developer docs -

https://shankar-k.medium.com/tesla-developer-api-guide-ble-key-pair-auth-and-vehicle-commands-part-3-485e4a357e7d

https://github.com/teslamotors/vehicle-command/tree/main/cmd/tesla-control

"Sending commands
You should now be able to send commands over BLE:

tesla-control -ble lock
If you've set up your OAuth token (see repository README file), you can also send commands over the Internet:

The words that stand out are If you've set up your OAuth token you can also send commands over the Internet." ie. internet authentication is not mandatory???

[MikeBishop]

Ah, you appear to be correct. The BLE code can be enrolled by using the keycard to approve it while physically in the car. That is promising!

[MikeBishop]

Since I was moving over to Fleet API proxy today, I tried getting the BLE working from the command line. I consistently got this:

Failed to execute command: MESSAGEFAULT_ERROR_INSUFFICIENT_PRIVILEGES

The Bluetooth tools in the OS seem to work, so I'm not sure what's up with that.

[alexeiw123]

@RichieB2B could you help with the final and crucial stage of getting TWCManager to use the fleetAPI, once I've got all the other steps sorted out? I assume somewhere I need to give it the appropriate addresses.

I have the cert hosted, call back etc. I did all this from the home assistant integration, which is working just fine now. I assume that I can use the same cert/app etc. for TWC Manager (hopefully teslamate as well). Any help appreciated. Manually starting the charge is feeling very old fashioned after using TWCManager without issue for so long!

[RichieB2B]

That is not supposed to happen. Check the modification time and permission of /etc/twcmanager/settings.json It should be writable by the twcmanager user.

[alexeiw123]

pi@TWCManager:/etc/twcmanager $ stat settings.json
  File: settings.json
  Size: 9003            Blocks: 24         IO Block: 4096   regular file
Device: b302h/45826d    Inode: 130187      Links: 1
Access: (0755/-rwxr-xr-x)  Uid: ( 1001/twcmanager)   Gid: ( 1001/twcmanager)
Access: 2024-02-05 14:16:34.871468161 +1100
Modify: 2024-04-30 08:30:41.974816083 +1000
Change: 2024-04-30 08:30:41.974816083 +1000
 Birth: -

I think this indicates twcmanager as owner and read/write and execute permissions? Also that it has been updated recently.
Things have been a little odd in my install for a while... for example:

Another possibility is that DNS sinking network ad-blocking is preventing some token refresh request?

[RichieB2B]

That stat looks ok. Check if you actually have a refresh token with:

jq '.carApiRefreshToken,.carApiTokenExpireTime' /etc/twcmanager/settings.json

You can convert the expiry time (the last line of that output) on https://www.epochconverter.com
Install jq with apt install jq if you do not have it yet.

[alexeiw123]

Yep, that returned a refresh token,
The time returned is about 6 hours ahead of now

[RichieB2B]

Check again in 6+ hours.. seems to be working as expected.