AlexxIT/go2rtc · error

failed to encrypt password

Error message

failed to encrypt password: %v

What it means

Wraps a failure from EncryptPassword() during Tuya cloud password login. The plaintext password must be RSA-encrypted with the public key (PbKey) returned in the token response before being sent. If encryption fails, login cannot proceed and the error is returned.

Solutions

1. Log the wrapped inner error to see the exact crypto failure (key parse vs padding)
2. Verify the Tuya password is set and non-empty in the go2rtc config
3. Check that tokenResp.Result.PbKey is present and is a valid PEM public key; update go2rtc if Tuya changed the response shape
4. Re-authenticate to fetch a fresh token — a stale/corrupt cached token response may lack PbKey
5. Test the same credentials in the Tuya app to rule out account-level issues

Example fix

// before
password: ""  # empty password in config
// after
password: "correct-tuya-app-password"  # non-empty; encryption then succeeds

// Go: guard before login flow
if password == "" { return errors.New("tuya password not configured") }
if tokenResp.Result.PbKey == "" { return errors.New("token response missing public key") }

if _, err := EncryptPassword(password, pbKey); err != nil {
    return fmt.Errorf("cannot login: bad key or password config: %w", err)
}

When it happens

Trigger: Calling the Tuya login flow when EncryptPassword(password, tokenResp.Result.PbKey) fails: empty or malformed PbKey from the token response, unsupported password characters/encoding, or an internal crypto (PEM parse / RSA) error.

Common situations: Tuya returned a token response without a public key (regional API change or degraded response); password contains characters that break the encoding step; misconfigured password field (empty) in go2rtc config.

Related errors

• ${loginResp.ErrorMsg}
• loginResp.ErrorMsg
• tuya:
• ${tokenResp.Msg}
• tuya

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/67c86c642df6e074. Report an issue: GitHub.

Appendix: source

Thrown at pkg/tuya/smart_api.go:437

	}

	body, err := c.request("POST", tokenUrl, tokenReq)
	if err != nil {
		return err
	}

	var tokenResp LoginTokenResponse
	if err := json.Unmarshal(body, &tokenResp); err != nil {
		return err
	}

	if !tokenResp.Success {
		return errors.New(tokenResp.Msg)
	}

	encryptedPassword, err := EncryptPassword(c.password, tokenResp.Result.PbKey)
	if err != nil {
		return fmt.Errorf("failed to encrypt password: %v", err)
	}
	var loginUrl string

	loginReq := PasswordLoginRequest{
		CountryCode: c.countryCode,
		Passwd:      encryptedPassword,
		Token:       tokenResp.Result.Token,
		IfEncrypt:   1,
		Options:     `{"group":1}`,
	}

	if IsEmailAddress(c.email) {
		loginUrl = fmt.Sprintf("https://%s/api/private/email/login", c.baseUrl)
		loginReq.Email = c.email
	} else {
		loginUrl = fmt.Sprintf("https://%s/api/private/phone/login", c.baseUrl)
		loginReq.Mobile = c.email
	}

View on GitHub (pinned to c245815e75)