Reverse Engineering the iHome iSP5 SmartPlug Communications

I got a couple of the iHome iSP5 Smart Plugs and wanted to integrate them into OpenHAB. This is just some rough digging I have done so far in the communications between the phone app and their server. Part 2, if I get to it will look at the communications between the server and the plug. This will be much harder as I will need to find a way to become a MITM for the SSL communications.

Maybe this will help someone create an openHAB binding as I have never really worked with OpenHAB.

The following is all done using CURL.

Get Your Authorization ID

To start off you need to send a request to their server with your login information to get the authorization ID to communicate with the device server.

curl -H "Content-Type: application/x-www-form-urlencoded" -H "Accept: application/json" -X POST -d 'password=yourPassword&'

The response to this will contain 2 important fields:

  • evrythng_user_id
  • evrythng_api_key

The evrythng_user_id isnt really useful but its nice to know. The evrythng_api_key is really where the magic happens.

Get Your Device ID(s)

Using the evrythng_api_key you can then send a packet to query all the things you have in your account. Replace evrythng_api_key with your actual value in the Authorization field.

curl -H "Content-Type: application/x-www-form-urlencoded" -H "Accept: application/json" -H "Authorization: evrythng_api_key"

This then returns a large JSON response with all your devices.

Most of these fields can then be queried later but a few are really the most important:

  • id (Unique device ID)
  • currentpowerstate1 (1=On, 0=Off)
  • outletinuse1 (1=yes, 0=no)
  • ~connected (true=Connected, false=Disconnected)

These fields are pretty self-explanatory. currentpowerstate1 is if the switch is on/off, outletinuse1 is if there is something actually plugged into it and, ~connected is if the device is connected to the internet/accessible.

Get Device Properties

To query the device for a specific property use a GET as follows and remember to replace id in the URL with the id you found in the last command:

curl -H "Content-Type: application/json" -H "Accept: application/json" -H "Authorization: evrythng_api_key"

Replace the last part of the URL with the property you want to query.

This query actually returns a few values so you may want to limit it to 1 instead of 100 to get the last result. I did also notice that the sortOrder didn’t appear to do anything but that may need to be experimented with a bit more.

Another example to get powerstate1

curl -H "Content-Type: application/json" -H "Accept: application/json" -H "Authorization: evrythng_api_key"

Setting A Property

To actually set a property value it’s basically the same except sending a PUT instead of a GET.

The following will turn the switch off:
curl -H "Authorization: evrythng_api_key" -H "Content-Type: application/json" -H "Accept: application/json" -H "Content-Length: 15" -X PUT -d '[{"value":"0"}]'

Ya, so that’s really all there is to it. I’m sure a binding would be pretty simple for someone.

Edit: So the communications between the server and the device are SSL encrypted so I dont have a way to see what its doing. I ran TCPdump on my router and I can see packets but nothing I can work with. Not sure if anyone has any ideas.

6 Reader Comments


First, thanks for doing the work to give me a bit of a jumpstart on my project to get my iHome outlets working with IFTTT.

I have tried using your format for setting a property to turn an outlet on or off. I am not getting a working result though. The evrythng API does return a positive result, but the actual power state of the outlet remains unaltered.

What I did notice though, is that the iHome Control Android app does reflect the change in powerstate, regardless of the actual status of the outlet, seemingly just fooling the app into thinking an outlet is on/off.

Would you possibly have any more information on this, or be able to point me at some of your sources for your research into this?


It seems that one might only want to retrieve individual properties if one wants the history of changes to them (which one apparently gets, at least for those that would have a history). Otherwise, wouldn’t it be more efficient to retrieve the info about all one’s devices (and just the current value of all their properties) with one call, rather than multiple calls to retrieve multiple properties? Not to mention that you’re getting a hopefully consistent point in time if you get it all at once.

If scripting, a tool like “jq” to parse the JSON makes it just about equally easy either way, whether to retrieve particular properties for particular devices from the saved results of a query listing all one’s devices, or to get just the most recent from the history of a single property.

I too couldn’t get writing to the state to work. It would update the value and the actual device would never change. A bit of poking around evrythng’s site I found the actions endpoint which listed the actions done on my device and they include _turnOn and _turnOff which did work:

curl -H “Content-Type: application/json” -H “Accept: application/json” -H “Authorization: ” -X POST “” -d ‘{“type”:”_turnOn”}’

Found possible actions here:
curl -H “Content-Type: application/json” -H “Accept: application/json” -H “Authorization: ” “”


is anyone still using these?
Just got a notification in the app that they will be shutting down their cloud service…

Hopefully they release the firmware or something so that these can be modified to still work somehow.


I’m still using 5 of them. They work flawlessly for me. I just have them all controlled by NodeRed. Disappointing if there isn’t a way to control them without the cloud.

This is exactly why devices that don’t require the cloud are infinitely more useful since now how many of these perfectly good switches are going to be rendered completely useless.

Leave a Comment