oneapp inspection - new auth and endpoints

[Mirarkitty]

I played with Claude a bit to inspect the new app, the auth system, and the new endpoints. There's some interesting finds, but someone that knows better than me how to do it need to get the client id out of the system.

"pet-care" was an interesting endpoint. Haven't seen that in the app yet. Ithink the analysis what we can get from kia-uvo is pessimistic, but there's some really nice new potential stuff like battery conditioning.

I don't know if this github repo is the right port of call for this, but it's where I would look for this, so...

Kia OneApp EU

Claude did a full static RE of the OneApp EU APK (jadx, no live traffic).
Auth flow, endpoint catalog, command surface are mapped. One hard blocker remains
(X-Stamp computed in native code).

Host	Purpose	Stamp?
idpconnect-eu.kia.com	OAuth2/PKCE login — shared with the captcha peukiaidm-online-sales flow	No
cci-api-eu.kia.com	User profile, agreements, notifications	No
egw-svchub-ccs-k-eu.eu-central.hmgmobility.com	Vehicle metadata, MQTT host discovery, connection state	No
oneapp.kia.com (Ktor)	App initialization, charging-station search, loyalty	No
gspa-ccs-eu.kia.com	All vehicle telemetry + all remote commands	Yes

Gating logic verified in com.hmg.ccs.sdk.data.common.header.RequestHeader.a:
Stamp is added iff authority.contains("gspa"). The Bearer token is unified
across all five hosts.

blocked at:

1. Production OneApp inner client_id (UUID) — xShield-encrypted in the APK
2. Outer login facade slug (likely peukiaidm-<role> — brute-discoverable against the IDP)
3. libgspa-cipher.so Stamp algorithm — needed only for the GSPA host
4. Production base URLs — xShield-encrypted, recoverable by several routes

Feature Matrix

Capability	kia_uvo	OneApp CCS2	Notes
Vehicle status (battery, climate, doors)	Yes	Yes	stored-status needs Stamp
Fresh GPS / location	Yes (workaround)	Yes	/location/vehicles/{carId}/stored-status needs Stamp
Live GPS poll (async)	No	Yes	/location/vehicles/{carId}/update-status needs Stamp
Door lock/unlock	Yes	Yes	/door action
Climate start/stop	Yes	Yes	/temperature action
Charge start/stop	Yes	Yes	/charge action
Target SOC (charge limit)	Partial	Yes	/charge-target
Scheduled charging	No	Yes	/reservation-charge
Scheduled HVAC departure	No	Yes	/reservation-hvac
Scheduled charge + HVAC	No	Yes	/reservation-charge-hvac
Battery conditioning (real)	Heuristic	Yes	OneApp: /battery-conditioning. kia_uvo fakes via max-defrost climate.
V2L discharging limit	No	Yes	/discharge-limit — V2H/V2L control
Pet care mode	No	Yes	/pet-care — climate without remote start
Per-wheel TPMS	No	Yes	CvDiagnostic suite
Frunk open/close	No	Yes	/frunk — EV9 front storage
Horn + hazard	Yes?	Yes	upstream start_hazard_lights / horn — verify on brain
Hazard lights only	Yes?	Yes	upstream — verify
Lamp turn-off	No	Yes	/lamp
Charge port open/close	Yes	Yes	confirmed in kia_uvo (user); OneApp: /portdoor
Window open/close	Yes	Yes	kia_uvo set_windows_state via WindowRequestOptions
Window curtain	No	Yes	/window-curtain
Rear seat alarm stop	No	Yes	/rearseat-alarm
Engine remote start (ICE)	No	Yes	/engine
Lock-and-start toggle	No	Yes	/lock-and-start-toggle
Charging current setting	No	Yes	/charging-current
Engine schedule (ICE)	No	Yes	gspa/v1/remote/vehicles/{carId}/reservation-engine
Charge complete alarm	No	Yes	/charge-alarm
PnC (Plug and Charge)	No	Yes	activatePncContract, deletePncContract
ECU diagnostics (DTC)	No	Yes	breakdowns endpoint
Valet mode on/off	No	Yes	/valet/control
Valet drive history	No	Yes	/valet/history
OTA SW update status	No	Yes	/ota-updates
OTA update trigger/schedule	No	Yes	/ota-updates, /ota-updates-reservation
Digital key management	No	Yes	dkc2/* endpoints
Send POI to car nav	No	Yes	/location/vehicles/{carId}/routes
Safety alerts (geofence, curfew)	No	Yes	/safety/vehicles/{carId}/alert-setting
Surround view images/video	No	Yes	svm/* endpoints
EpitChargeStatus	No	Yes	External plug-in power management
Weather at vehicle location	No	Yes	/gspa/v1/contents/wts/weathers
Charging station search	No	Yes	Ktor ChargeApi
Charge history/sessions	No	Yes	Ktor ChargeApi — history only, no current SOC
Driving insights / odometer	No	Yes	Ktor — odometer value, not real-time
Loyalty points	No	Yes	Ktor
Vehicle list (existence)	Limited	Yes	available-vehicles, metadatalist — name/VIN only
Vehicle connection state	No	Yes	vstatus/connstate — online/offline boolean only
MQTT real-time command status	No	Yes	Service hub MQTT — but commands are GSPA-gated
Multiple vehicle support	Limited	Yes	available-vehicles

HANDOFF.md

I'll fill in with more documentation, but I need someone to get the auth path straightened out.

[Mirarkitty]

README.md

dtos.md
envelope.md
enums.md
headers.md
auth.md

[Mirarkitty]

openapi.yaml.txt

[blka]

We looked into the CCI EU endpoints for Hyundai (same CCS2 architecture as Kia) and can confirm the auth flow structure. The POST /domain/api/v1/auth/token endpoint that exchanges the Keycloak auth code for access/refresh tokens requires an X-Fingerprint header (Hyundai) / X-Stamp (Kia). Without it the API returns error 9035.

From our testing:

• Initial login (authorization_code grant) is blocked without the native header. The header is an HMAC computed from request headers + timestamp + a static secret, and it appears to be generated inside the native app layer. Reconstructing it outside the app is non-trivial.
• Token refresh (POST /v2/auth/token-refresh) works without the header — if you already have a valid refreshToken, you can renew indefinitely.

The practical blocker is the initial token acquisition. The only workaround we see is automating the web Keycloak login (which may trigger captcha and/or 2FA) and then capturing the auth code, but that requires a full browser stack (Playwright/Selenium) inside the library — not ideal for a lightweight Python package or Home Assistant integration.

Because of that, we don't plan to implement the CCI login flow in hyundai_kia_connect_api until there's a clean, browser-less way to obtain the first refresh token. The existing CCSP API is still working for EU Hyundai/Kia and covers the basic vehicle controls, so that's the path we'll keep maintaining for now.

Happy to revisit if anyone finds a way to get past the initial auth without a browser.

[Mirarkitty]

I started the research mainly so we have a plan if/when they block the old API. The auth/token part seems indeed tricky.

[Mirarkitty]

I have most of the the oath flow, I will try the login sequence later. It was quite a deep dive into the obfuscating libraries and it still needs a library (libgspa-cipher.so) extracted from the phone using apk. It's using magic check sums to look up things...

Hyundai might differ, I have the Kia but it's AES-CFB...

So I have oath clients, and hosts, OIDC endpoints, and a bunch of UUID. Should I share them here?

[github-actions]

This issue is stale because it has been open for 60 days with no activity. Are you still experiencing this issue?

[andypiper]

Looks like this is very much an active issue again, since Kia's API is now blocking the previous client ID.