SharkIQ showing 0 devices despite successful authentication and device showing in app

[TheOneOgre]

Users have reported issues regarding successful authentication, but the API returning 0 devices.

Originally posted by @DutchMon in #141 (comment)

[DutchMon]

ok so I have found my devices!!

It looks like SharkClean has moved (at least for some accounts / device models) to a new “end-user” backend that is not Ayla for device inventory.

When I MITM’d the SharkClean Android app, the app did not fetch my robot list from the Ayla endpoints (ads-*.aylanetworks.com/apiv1/devices.json). Instead it called:

• https://login.sharkninja.com/oauth/token (Auth / tokens)

• https://<cluster>.thor.skegox.com/householdsEndUser?...

• https://<cluster>.thor.skegox.com/devicesEndUserController/<householdId>/users/<userId>?includeRegistry=true&includeConnectivityStatus=true&includeShadow=true

Those thor.skegox.com calls returned my full robot inventory (deviceId, model, registry, shadow, connectivity, room list, etc.).

Crucially, requests to thor.skegox.com are not just “Bearer token” — they also include extra controls like:

• x-api-key: ...

• x-iotn-request-signature: SN-HMAC-SHA256 ...

• x-sn-date / x-sn-nonce (part of the signature)

That's all I can figure out at the moment...

[TheOneOgre]

So, unbeknownst to me, until just now, this is an issue that was previous tracked at home-assistant/core#153584

So it's not a new thing, but I myself didn't know about this, and can start work on trying to get this working. Figuring out the correct way to pull the , householdId, and userId, I think is going to be the biggest issue, and moreso because I don't have a device that is connected this way.

If you could, if you still have that mitm capture, of if you could again, A single captured request to stakra.slatra.thor.skegox.com with headers intact (x-api-key, x-sn-date, x-sn-nonce, x-iotn-request-signature, Authorization, etc.) plus method/path/query and body (if any). With that I can derive the HMAC signing string. You can redact the private information and see if I can work with that, although I may need an actual, full authorization string at some point to be able to derive the HMAC.

Starting there and then working further may require sharing private details, maybe made via a dummy account unless I can access it myself.

But I will try! Thanks for the capture, every bit helps!

[DutchMon]

Yeah, I've go that saved! I'll first redact private details and attach that here and then we can go from there.

@TheOneOgre here's the redacted mitmproxy flow exported in json
sharkiq_redacted.json

[TheOneOgre]

That's great, I've got the HMAC portion but I need the x-api-key. That part in particular is not private info, the x-api-key is hardcoded and will be the same for everyone, that's the important bit I need. However, if you are uncomfortable with sharing it here, you could DM me with it somewhere, as it may not be better to post it here for online search access. Though, it will eventually be included in code, if maybe obfuscated a bit.

[DutchMon]

I just wasn't sure, so removed it just in case! (Just realized I misread your "headers intact" part earlier)

Here it is:
Redacted, to prevent indexing, just in case, ;) ~ TheOneOgre

[TheOneOgre]

So, I did some work and the x-api-key is correct, but, I'm missing the HMAC signature key that is pulled down during runtime. When you ran MITM, were you already signed in?

If you were, could you sign out, run mitm, and then sign in, and see if during any of the GET requests, there's an HMAC signature key that is pulled down from ayla, shark, skegox etc?

That key will also be a static key for every user. Your token, household, and userid are what is identifying. This is a very interesting authentication layer they've implemented. I'm trying to authenticate and see how the householdid and userid is pulled. I think your refresh token is what is used as an identifier to fetch your household and user, but that's speculation. If any of the requests return those, let me know the request the app makes.

I appreciate your effort into working with me on this, I really wanna get this working for everyone.

[DutchMon]

I will look through the saved requests I made when running MITM.
Initially, It was a struggle to get my android emulator setup.
Then I had to install an old version of the SharkClean app to avoid the Google Play verification. Then I signed in on the old version. Finally, I updated the SharkClean app to the latest version and when opening the app, I was shown a popup stating there is no Google Play installed so it was going to close, but my MITM already stored those requests that I shared in the file.

That being said, I might not be able to look too much this weekend, but Monday I can definitely dig around some more.

[DutchMon]

@TheOneOgre alright, here's all of the requests I had prior to the ones I already sent. Let me know if this is enough because if it's not then I will have to modify my virtual android device further to bypass the Google Play License verification.

Redacted for userid.

[TheOneOgre]

@TheOneOgre alright, here's all of the requests I had prior to the ones I already sent. Let me know if this is enough because if it's not then I will have to modify my virtual android device further to bypass the Google Play License verification.

sharkiq_prior.json

I'll check all through this and see what I can use. I was struggling myself to get it to run properly in emulator. Tried adding a frida gadget patch, custom packing, replacing manifests.....didn't even think to use an older version... Great idea lol.

Thanks for your help, will come back with an update if I find anything remotely usable!

[DutchMon]

Glad I could help!

For my emulator, I was using a Frida server with this universal pinning bypasser script and I'm looking into using something like this PlayIntegrityFix as well if I need.

[triosniolin]

Just thought I'd add, I was able to get successfully authenticated, but the integration is not actually working as @TheOneOgre suspected. Not updating device status, can't run any cleaning cycles, rooms not appearing in HA, etc. In the middle of this log I used the Shark app to start a clean and nothing seems to have changed.

home-assistant_sharkiqdev_2026-01-09T07-15-19.296Z.log

[jweinberg]

Does this look like it's fixable? I'm in this state as well but am happy to provide whatever logging I can