RPC calls via websocket and nonce

  • Hi all,

    First-time poster here.

    I have some questions on https://shelly-api-docs.shelly.cloud/gen2/General/Authentication. The documentation says:

    When communicating over HTTP, this process must be repeated for each request you send to the device. However, for communication over websocket there is no need to pass through steps 1 and 2 more than once: you need to construct the auth object only once(see more about that below) and then use it for all consecutive requests to that device.

    However, I am not sure that is correct. I am using homebridge with the homebridge-shelly-ng plugin and while controlling a Shelly Plus 2PM works right after restarting homebridge, it stops working after about an hour with:

    Code
    {
    code: 401,
    message: '{"auth_type": "digest", "nonce": 1685710700, "nc": 1, "realm": "shellyplus2pm-<id>", "algorithm": "SHA-256"}'
    }

    What's interesting here is that the returned nonce is different from the one received during the initial auth, apparently it expires after about an hour. If I re-generate the auth with the new nonce, it works again. As far as I can see neither homebrdige itself nor the plugin (precisely the npm package shellies-ng) close the websocket, so to me it sounds like the documentation contradicts the implementation and re-auth is in fact necessary after some time.

    Does anyone have any insights on this?

    Thanks in advance!