Code — Hap 5.1 Authorization

| Property | How HAP 5.1 ensures it | |----------|------------------------| | Replay attack | Timestamp + single-use nonce | | Man-in-the-middle | Encrypted with accessory’s public key | | Brute force | Code invalid after 3 failures within 10 sec | | Session isolation | Each auth code links to a specific pairing ID |

The Authorization Code is not a human-readable text but a crypto structure: hap 5.1 authorization code

If your authentication flow relies on a custom URL scheme (e.g., myapp://auth-callback), you must declare it. | Property | How HAP 5

Code Example:

<queries>
    <intent>
        <action android:name="android.intent.action.VIEW" />
        <data android:scheme="mycustomauth" />
    </intent>
</queries>

The HAP 5.1 authorization code in libraries like hap-python is stored in the config.json file: Algorithm : Ed25519 or X25519 depending on iOS/tvOS version

  "pin": "111-22-333",
  "authorizationCode": "f7d3a1e8b9c2468d5f0e3a7b1c9d4e2f",
  "version": "5.1"

Important: Never commit your actual authorizationCode to GitHub. Use environment variables.