[App][Pro] Refoss Energy Monitor

Apps
1

Hello,

I wanted to integrate Refoss Energy meter into Homey pro. Since there is no existing app, I built one. I am using its Open API to talk to the device locally and show all CT’s in Homey Pro app. You can use multiple flows to get alerts, set fixed Energy prices to see the amount it cost to run for the day, week or month in the widgets. These devices show up in Homeys Energy dashboard as Main Panel Energy monitor or Consumer devices which can be set in individual device settings.

For now EM06p and EM16P models work. I test the app with EM16P. App can be found here

SETUP

  1. Make sure your Refoss device is on the same local network as your Homey Pro
  2. Find the device IP address in your router’s DHCP table or the Refoss app
  3. In Homey, go to Devices > Add Device > Refoss Energy Monitor
  4. Select the device model and enter its IP address
  5. For EM06P / EM16P, select which channels to add and optionally rename them

KNOWN ISSUES

Right now only polling the device seems to work. This is done automatically every 60 sec.Although there is code for automatic webhook registration, where the device will send values on change, it doesnt seem to work. not sure if it is my network issue or app issue. investigating it.

If you have this device intsall it, use it and provide feedback. Thanks.

Screenshot_20260224_224309_Homey
Screenshot_20260224_224309_Homey1080×2340 204 KB

Screenshot_20260224_224411_Homey
Screenshot_20260224_224411_Homey1080×2340 255 KB

Screenshot_20260224_224340_Homey
Screenshot_20260224_224340_Homey1080×2340 243 KB

Screenshot_20260224_224325_Homey
Screenshot_20260224_224325_Homey1027×3928 308 KB

2

Bug: app cannot authenticate when device-local auth is enabled (EM06P, fw 2.1.13) — Digest is MD5-only, device requires SHA-256

Setting up an EM06P on Homey Pro (Early 2023, fw 13.4.1-rc.3), app v2.0.10. Device paired fine, but the parent device immediately went Device unreachable and all six channel devices stayed at null (expected — channels don’t poll, they get data from the parent).

The device was reachable the whole time. The cause is the Digest implementation in lib/RefossApi.js.

1. Device info works — no auth needed, and it advertises auth is on

$ curl -s http://<device-ip>/rpc/Refoss.DeviceInfo.Get
{"name":"Refoss Smart Energy Monitor","model":"em06p",
 "dev_id":"refoss-em06p-c4e7ae******","api_ver":"1.0",
 "fw_ver":"2.1.13","hw_ver":"2.0.0","auth_en":true}

2. Data endpoint returns 401, and the challenge asks for SHA-256

$ curl -s -i http://<device-ip>/rpc/Refoss.Status.Get
HTTP/1.1 401 Unauthorized
Www-Authenticate: Digest qop="auth", realm="refoss-em06p-c4e7ae******",
                  nonce="1786889468", algorithm=SHA-256
Server: RefossHTTP/1.0.0

3. Why the app can never satisfy it — lib/RefossApi.js:

js

function md5(str) {
  return crypto.createHash('md5').update(str).digest('hex');
}

function buildDigestHeader({ username, password, method, path, challenge, nc, cnonce }) {
  const { realm, nonce, qop, opaque, algorithm } = challenge;
  const ha1 = (algorithm || '').toUpperCase() === 'MD5-SESS'
    ? md5(`${md5(`${username}:${realm}:${password}`)}:${nonce}:${cnonce}`)
    : md5(`${username}:${realm}:${password}`);
  const ha2 = md5(`${method}:${path}`);
  ...
}

Every hash is MD5; there is no SHA-256 branch. So the response digest is always wrong for this firmware and the retry after 401 fails permanently — the user just sees Device unreachable with no hint that it’s an auth problem.

Second, smaller issue in the same path — the challenge parser only accepts quoted values:

js

const re = /(\w+)="([^"]+)"/g;

The device sends algorithm=SHA-256 unquoted, so algorithm is never even parsed. Both qop="auth" and realm="..." are quoted and do parse, which is why this goes unnoticed.

Suggested fix: pick the hash function from the challenge (MD5, MD5-sess, SHA-256, SHA-256-sess) instead of hardcoding MD5, and relax the parser to accept unquoted parameter values. RFC 7616 §3.3.

Workaround: disable local authentication on the device in the Refoss app. auth_en becomes false, Refoss.Status.Get returns 200 and everything works — all six channels report immediately. Obviously not ideal, since it leaves the RPC API (including Em.Config.Set) open to anyone on the LAN.

One request while you’re in there: it would help a lot if the poll failure surfaced the underlying error. Device unreachable. Check IP address and network connection. sent me looking at the network for a while, when the device was answering 401 the entire time.