{"record":{"id":"67c86c642df6e074","repo":"AlexxIT/go2rtc","slug":"failed-to-encrypt-password-v-67c86c","errorCode":null,"errorMessage":"failed to encrypt password: %v","messagePattern":"failed to encrypt password: (.+?)","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/tuya/smart_api.go","lineNumber":437,"sourceCode":"\t}\n\n\tbody, err := c.request(\"POST\", tokenUrl, tokenReq)\n\tif err != nil {\n\t\treturn err\n\t}\n\n\tvar tokenResp LoginTokenResponse\n\tif err := json.Unmarshal(body, &tokenResp); err != nil {\n\t\treturn err\n\t}\n\n\tif !tokenResp.Success {\n\t\treturn errors.New(tokenResp.Msg)\n\t}\n\n\tencryptedPassword, err := EncryptPassword(c.password, tokenResp.Result.PbKey)\n\tif err != nil {\n\t\treturn fmt.Errorf(\"failed to encrypt password: %v\", err)\n\t}\n\tvar loginUrl string\n\n\tloginReq := PasswordLoginRequest{\n\t\tCountryCode: c.countryCode,\n\t\tPasswd:      encryptedPassword,\n\t\tToken:       tokenResp.Result.Token,\n\t\tIfEncrypt:   1,\n\t\tOptions:     `{\"group\":1}`,\n\t}\n\n\tif IsEmailAddress(c.email) {\n\t\tloginUrl = fmt.Sprintf(\"https://%s/api/private/email/login\", c.baseUrl)\n\t\tloginReq.Email = c.email\n\t} else {\n\t\tloginUrl = fmt.Sprintf(\"https://%s/api/private/phone/login\", c.baseUrl)\n\t\tloginReq.Mobile = c.email\n\t}","sourceCodeStart":419,"sourceCodeEnd":455,"githubUrl":"https://github.com/AlexxIT/go2rtc/blob/c245815e75e2a5fd60b4290f12bfc04e55a984d3/pkg/tuya/smart_api.go#L419-L455","documentation":"Wraps a failure from EncryptPassword() during Tuya cloud password login. The plaintext password must be RSA-encrypted with the public key (PbKey) returned in the token response before being sent. If encryption fails, login cannot proceed and the error is returned.","triggerScenarios":"Calling the Tuya login flow when EncryptPassword(password, tokenResp.Result.PbKey) fails: empty or malformed PbKey from the token response, unsupported password characters/encoding, or an internal crypto (PEM parse / RSA) error.","commonSituations":"Tuya returned a token response without a public key (regional API change or degraded response); password contains characters that break the encoding step; misconfigured password field (empty) in go2rtc config.","solutions":["Log the wrapped inner error to see the exact crypto failure (key parse vs padding)","Verify the Tuya password is set and non-empty in the go2rtc config","Check that tokenResp.Result.PbKey is present and is a valid PEM public key; update go2rtc if Tuya changed the response shape","Re-authenticate to fetch a fresh token — a stale/corrupt cached token response may lack PbKey","Test the same credentials in the Tuya app to rule out account-level issues"],"exampleFix":"// before\npassword: \"\"  # empty password in config\n// after\npassword: \"correct-tuya-app-password\"  # non-empty; encryption then succeeds","handlingStrategy":"validation","validationCode":"// Go: guard before login flow\nif password == \"\" { return errors.New(\"tuya password not configured\") }\nif tokenResp.Result.PbKey == \"\" { return errors.New(\"token response missing public key\") }","typeGuard":null,"tryCatchPattern":"if _, err := EncryptPassword(password, pbKey); err != nil {\n    return fmt.Errorf(\"cannot login: bad key or password config: %w\", err)\n}","preventionTips":["Never leave the Tuya password empty in config","Validate token response contains PbKey before login","Update go2rtc when Tuya changes login API shape","Test credentials in the Tuya app when login keeps failing"],"tags":["tuya","authentication","encryption","login"],"backgroundTag":"missing-credentials","analyzedSha":"c245815e75e2a5fd60b4290f12bfc04e55a984d3","analyzedAt":"2026-09-07T11:47:02.965Z","contentChangedAt":"2026-09-07T11:47:02.965Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}