User Authentication in SmartThings

[Gaurav_Goyal]

Hey everyone.

I’m quite curious about how the SmartThings Cloud binds with a Mobile Phone having SmartThings Application. Also whenever a command is being sent from user by Mobile Application, how do SmartThings cloud authenticates that user and further process the commands.

[JDRoberts]

See discussion in your other topic. I don’t believe these details have been published.

SmartThings has published a white paper on platform security that addresses some of these issues, although it may be out of date.

SmartThings Security Approach - Abstract

Hi all – I know there’s been some questions and discussion around the security approaches that we’ve taken in building the SmartThings Platform, so I wanted to make this paper available to all of you. It’s an abstract that describes our security approach at a high-level, and we’ll release a much more detailed paper in the Fall. Abstract - SmartThings Security Strategy & Approach Thanks, Dan Lieberman SmartThings, Inc.

For additional discussion, see your other thread on events.

Events in SmartThings

[JDRoberts]

We should add that in 2020 SmartThings added optional two factor authentication to the mobile app.

[JillRojas]

A user first taps on a My SmartThings icon in your application. Your application must then redirect the user to the SmartThings accounts server by calling an OAth endpoint. You can exchange this code for an access token in a subsequent POST request to SmartThings.

[TonyBurgess]

A third-party application must authenticate with SmartThings using the Authorization Code flow. how to install iMessage on Windows A user first taps on a My SmartThings icon in your application.