SmartThings OAuth Changes

[slagle]

Hello fellow devs! We are announcing an important change that will impact some application development on the SmartThings platform.

Starting February 1st, SmartApps that are not approved and published through official the SmartThings submission process will no longer be able to install OAuth endpoints into others accounts. OAuth endpoints in your own account will continue working. This change is required to protect the privacy and security of customers of 3rd party apps as well as SmartThings customers. In addition, this change provides the ability for published SmartApps to function in global markets as SmartThings expands. Therefore we are asking that all such SmartApps be submitted for review and publication.

If you haven’t seen them already, you will find changes to the Web Services SmartApp section as well as Service Managers in the newly published changes to the developer docs. These changes to the SmartThings OAuth flow to allow for global availability are presented alongside best practices to follow when you are using OAuth within the SmartThings ecosystem.

If you already have a popular smartapp that is installed using the OAuth method, we will fast-track review of these submissions in order to get them in prior to the deadline but in order to process your submission and publish the applications we are requesting that submissions be made by January 20th. We’re here to help you if you have any questions so please don’t hesitate to ask @jodyalbritton and I any questions regarding these changes.

---

UPDATE: This change has been put on hold until we can get all the OAuth apps reviewed and published. Will update with a new date once we have these apps published.

---

UPDATE: These OAuth changes will be in affect starting April 1, 2016.

---

UPDATE: These changes are now live.

[MichaelS]

To be clear, this is only for 'auto install' apps...not for apps that the user downloads code and enable OAuth on their own?

[slagle]

You got it @MichaelS

As long as the customer can see the code they are allowed to use it.

[kurtsanders]

For example, SmartTiles would be an 3rd party application using OAuth that needs ST approval? Will there be a published list of those approved 3rd party OAuth and will the application break and that will be our notice?

[Mbhforum]

I hope Harmony integration doesn't break

[tgauchat]

This change is required to protect the privacy and security of customers of 3rd party apps as well as SmartThings customers.

While I do not disagree with the value of this change for various good reasons, I think it is important to note that the incremental difference in "security" related to this change should not be over emphasized.

There is already a discussion on the details of this (please hop over to that discussion linked below to catch up on all the details, rather than taking this Announcement on a tangent, thanks!).

SmartTiles (& "other" External Services) Security

"Officially" published Third-Party services (via the method above, OAuth Web Services SmartApps) do have their SmartApps only go through a review process (by SmartThings) before being published, which does not significantly increase trustworthiness of the service, though, because SmartThings still has no control of the actual Third-Party service.

[tgauchat]

For example, SmartTiles would be an 3rd party application using OAuth that needs ST approval? Will there be a published list of those approved 3rd party OAuth and will the application break and that will be our notice?

SmartTiles is indeed a SmartApp using this "shared" OAuth installation method. It is not an extremely common method so the chances that you are using many other affected SmartApps isn't too high.

However, SmartThings doesn't really have a way "at their fingertips" to find all such SmartApps at this time (to my knowledge), and so it is up to the Developers of the SmartApps to submit them for Marketplace listing and inform their users of any updated versions or installation procedures.

[slagle]

However, SmartThings doesn't really have a way "at their fingertips" to find all such SmartApps at this time (to my knowledge), and so it is up to the Developers of the SmartApps to submit them for Marketplace listing and inform their users of any updated versions or installation procedures.

We do we reached out to all affected developers.

Will there be a published list of those approved 3rd party OAuth and will the application break and that will be our notice?

It's up to the app developer to inform their user community, same as any other development platform. We reached out to every app developer who used this method and gave them a personal warning. Outside of sharptools, smartrules, and SmartTiles, this affected about 500 or so users.

SmartRules and SharpTools have been through this process already and their userbase is migrated. SmartTiles is next

[JoeC]

Hey @slagle , the Simple Rule Builder SmartApp was submitted for review a few months ago. Any chance you can help make sure it gets reviewed before the deadline?

[thrash99er]

Does this mean that SmartTiles won't work now??

[slagle]

It will continue to work if you already have it installed. We are working with them to get it ready for the cut off as well.

[slagle]

UPDATE: This change has been put on hold until we can get all the OAuth apps reviewed and published. Will update with a new date once we have these apps published.

[JDRoberts]

Does this have anything to do with the "object object" bug which appeared in the last week and prevents the addition of any new devices for either echo or harmony? And if so, does putting the change on hold mean the bug will go away?

http://thingsthataresmart.wiki/index.php?title=Bug:_object,_object_instead_of_device_name

[slagle]

Does this have anything to do with the "object object" bug which appeared in the last week and prevents the addition of any new devices for either echo or harmony?

No. The changes were put on hold so we can get the endpoints published.

[RBoy]

So Tim, is the process for reviewing new submitted apps streamlined?
If there some way to have custom DH's also included as part of this process?

[slagle]

Custom DH's are a whole different beast. There is a lot we need to understand and figure out from a UX perspective. But it is something we are talking about, but right now, it is not a super high priority.

We are also working on streamlining the SA submission process even further as well.

[Silverpawn]

Has anyone put together a list of the major 3rd Party smartapps that are not going to work as we've just started to see some issues where apps have stopped working. But at the moment it's not clear whether this is the cause.

oAuth Issues all cloud to cloud integrations broken (02/05/16)

Is anyone else having issues with Alexa, IFTTT, SmartTiles, LIFX, Sharptools? it seems all my stuff is broken as all my Tokens have become invalid and i am unable to re-authorize or indeed either delete and start again. everything broke about an hour and a half ago

[CrystalStylez]

Me personally I am unable to use sharptools and cannot authorize anything. SmartTiles and echo work fine.

[slagle]

But at the moment it's not clear whether this is the cause.

It was unrelated. See my response in the thread you posted.

[connectedhometeam]

Hi Tim @slagle,

I'm part of a team that is currently developing a platform that monitors (among other things) SmartThings devices in a user's home looking for specific events that could be used to trigger further actions that our platform can then take on the user's behalf.

Since the change in the OAuth behaviors noted here, we have been unable to fully test our platform against the SmartThings environment. We submitted our Smart App for review/publication 7 days ago (Monday 2 May) and have seen no status updates on our submission since then.

Can you provide an ETA of when we can expect an update on our request? Our development efforts are being impacted by this, and not having an ETA complicates our testing and development planning efforts.

I'd be happy to speak with you further, if you can provide a private channel for us to discuss specifics.

Thank you!