
Security News
/Research
Popular node-ipc npm Package Infected with Credential Stealer
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.
@switchbot/openapi-cli
Advanced tools
Command-line interface for the SwitchBot API v1.1. List devices, query live status, send control commands, run scenes, and manage webhooks โ all from your terminal or shell scripts.
@switchbot/openapi-cli/v1.1 endpoint (devices, scenes, webhooks)--json passthrough for jq and scripting0600; env-var override for CInpm install -g @switchbot/openapi-cli
This adds the switchbot binary to your $PATH.
git clone https://github.com/OpenWonderLabs/switchbot-openapi-cli.git
cd switchbot-openapi-cli
npm install
npm run build
npm link # optional โ expose `switchbot` globally
Verify:
switchbot --version
switchbot --help
# 1. Save your credentials (one-time)
switchbot config set-token <token> <secret>
# 2. List every device on your account
switchbot devices list
# 3. Control a device
switchbot devices command <deviceId> turnOn
The CLI reads credentials in this order (first match wins):
SWITCHBOT_TOKEN and SWITCHBOT_SECRET~/.switchbot/config.json (written by config set-token, mode 0600)Obtain the token and secret from the SwitchBot mobile app: Profile โ Preferences โ Developer Options โ Get Token.
# One-time setup (writes ~/.switchbot/config.json)
switchbot config set-token <token> <secret>
# Or export environment variables (e.g. in CI)
export SWITCHBOT_TOKEN=...
export SWITCHBOT_SECRET=...
# Confirm which source is active and see the masked secret
switchbot config show
| Option | Description |
|---|---|
--json | Print the raw JSON response instead of a formatted table |
-v, --verbose | Log HTTP request/response details to stderr |
--dry-run | Print mutating requests (POST/PUT/DELETE) without sending them |
--timeout <ms> | HTTP request timeout in milliseconds (default: 30000) |
--config <path> | Override credential file location (default: ~/.switchbot/config.json) |
-V, --version | Print the CLI version |
-h, --help | Show help for any command or subcommand |
Every subcommand supports --help, and most include a parameter-format reference and examples.
switchbot --help
switchbot devices command --help
--dry-runIntercepts every non-GET request: the CLI prints the URL/body it would have
sent, then exits 0 without contacting the API. GET requests (list, status,
query) are still executed so you can preview the state involved.
switchbot devices command ABC123 turnOn --dry-run
# [dry-run] Would POST https://api.switch-bot.com/v1.1/devices/ABC123/commands
# [dry-run] body: {"command":"turnOn","parameter":"default","commandType":"command"}
config โ credential managementswitchbot config set-token <token> <secret> # Save to ~/.switchbot/config.json
switchbot config show # Print current source + masked secret
devices โ list, status, control# List all physical devices and IR remote devices
# Columns: deviceId, deviceName, type, controlType, family, roomID, room, hub, cloud
switchbot devices list
switchbot devices list --json | jq '.deviceList[].deviceId'
# Filter by family / room (family & room info requires the 'src: OpenClaw'
# header, which this CLI sends on every request)
switchbot devices list --json | jq '.deviceList[] | select(.familyName == "Home")'
switchbot devices list --json | jq '[.deviceList[], .infraredRemoteList[]] | group_by(.familyName)'
# Query real-time status of a physical device
switchbot devices status <deviceId>
switchbot devices status <deviceId> --json
# Send a control command
switchbot devices command <deviceId> <cmd> [parameter] [--type command|customize]
# Describe a specific device (1 API call): metadata + supported commands + status fields
switchbot devices describe <deviceId>
switchbot devices describe <deviceId> --json
# Discover what's supported (offline reference, no API call)
switchbot devices types # List all device types + IR remote types
switchbot devices commands <type> # Show commands, parameter formats, and status fields
switchbot devices commands Bot
switchbot devices commands "Smart Lock"
switchbot devices commands curtain # Case-insensitive, substring match
parameter is optional โ omit it for commands like turnOn/turnOff (auto-defaults to "default").
Numeric-only and JSON-object parameters are auto-parsed; strings with colons / commas / semicolons pass through as-is.
For the exact commands and parameter formats a specific device supports, query the built-in catalog:
switchbot devices commands <type> # e.g. Bot, Curtain, "Smart Lock", "Robot Vacuum Cleaner S10"
Generic parameter shapes (which one applies is decided by the device โ see the catalog):
| Shape | Example |
|---|---|
| (none) | devices command <id> turnOn |
<integer> | devices command <id> setBrightness 75 |
<R:G:B> | devices command <id> setColor "255:0:0" |
<direction;angle> | devices command <id> setPosition "up;60" |
<a,b,c,โฆ> | devices command <id> setAll "26,1,3,on" |
<json object> | '{"action":"sweep","param":{"fanLevel":2,"times":1}}' |
| Custom IR button | devices command <id> MyButton --type customize |
For the complete per-device command reference, see the SwitchBot API docs.
scenes โ run manual scenesswitchbot scenes list # Columns: sceneId, sceneName
switchbot scenes execute <sceneId>
webhook โ receive device events over HTTP# Register a receiver URL for events from ALL devices
switchbot webhook setup https://your.host/hook
# Query what is currently configured
switchbot webhook query
switchbot webhook query --details https://your.host/hook
# Enable / disable / re-submit the registered URL
switchbot webhook update https://your.host/hook --enable
switchbot webhook update https://your.host/hook --disable
# Remove the configuration
switchbot webhook delete https://your.host/hook
The CLI validates that <url> is an absolute http:// or https:// URL before calling the API. --enable and --disable are mutually exclusive.
completion โ shell tab-completion# Bash: load on every new shell
echo 'source <(switchbot completion bash)' >> ~/.bashrc
# Zsh
echo 'source <(switchbot completion zsh)' >> ~/.zshrc
# Fish
switchbot completion fish > ~/.config/fish/completions/switchbot.fish
# PowerShell (profile)
switchbot completion powershell >> $PROFILE
Supported shells: bash, zsh, fish, powershell (pwsh is accepted as an alias).
list/status, key-value tables for details.--json โ raw JSON passthrough, ideal for jq and scripting.switchbot devices list --json | jq '.deviceList[] | {id: .deviceId, name: .deviceName}'
| Code | Meaning |
|---|---|
0 | Success (including --dry-run intercept) |
1 | Runtime error โ API error, network failure, missing credentials |
2 | Usage error โ bad flag, missing/invalid argument, unknown subcommand, unknown device type, invalid URL, conflicting flags |
Typical errors bubble up in the form Error: <message> on stderr. The SwitchBot-specific error codes that get mapped to readable English messages:
| Code | Meaning |
|---|---|
| 151 | Device type error |
| 152 | Device not found |
| 160 | Command not supported by this device |
| 161 | Device offline (BLE devices need a Hub) |
| 171 | Hub offline |
| 190 | Device internal error / server busy |
| 401 | Authentication failed (check token/secret) |
| 429 | Request rate too high (10,000 req/day cap) |
| Variable | Description |
|---|---|
SWITCHBOT_TOKEN | API token โ takes priority over the config file |
SWITCHBOT_SECRET | API secret โ takes priority over the config file |
NO_COLOR | Disable ANSI colors in all output (automatically respected) |
# Turn off every Bot device
switchbot devices list --json \
| jq -r '.deviceList[] | select(.deviceType == "Bot") | .deviceId' \
| while read id; do switchbot devices command "$id" turnOff; done
# Dump each scene as `<id> <name>`
switchbot scenes list --json | jq -r '.[] | "\(.sceneId) \(.sceneName)"'
git clone https://github.com/OpenWonderLabs/switchbot-openapi-cli.git
cd switchbot-openapi-cli
npm install
npm run dev -- <args> # Run from TypeScript sources via tsx
npm run build # Compile to dist/
npm test # Run the Vitest suite (282 tests)
npm run test:watch # Watch mode
npm run test:coverage # Coverage report (v8, HTML + text)
src/
โโโ index.ts # Commander entry; mounts all subcommands; global flags
โโโ auth.ts # HMAC-SHA256 signature (token + t + nonce โ sign)
โโโ config.ts # Credential load/save; env > file priority; --config override
โโโ api/client.ts # axios instance + request/response interceptors;
โ # --verbose / --dry-run / --timeout wiring
โโโ devices/catalog.ts # Static catalog powering `devices types`/`devices commands`
โโโ commands/
โ โโโ config.ts
โ โโโ devices.ts
โ โโโ scenes.ts
โ โโโ webhook.ts
โ โโโ completion.ts # `switchbot completion bash|zsh|fish|powershell`
โโโ utils/
โโโ flags.ts # Global flag readers (isVerbose / isDryRun / getTimeout / getConfigPath)
โโโ output.ts # printTable / printKeyValue / printJson / handleError
tests/ # Vitest suite (282 tests, mocked axios, no network)
Releases are cut on tag push and published to npm by GitHub Actions:
npm version patch # bump version + create git tag
git push --follow-tags
Then on GitHub โ Releases โ Draft a new release โ select tag โ Publish. The publish.yml workflow runs tests, verifies the tag matches package.json, and publishes @switchbot/openapi-cli to npm with provenance.
Bug reports, feature requests, and PRs are welcome.
npm test and npm run build locally โ both must pass.main. CI runs on Node 18/20/22; all three must stay green.MIT ยฉ chenliuyun
https://api.switch-bot.comFAQs
SwitchBot smart home CLI โ control devices, run scenes, stream real-time events, and integrate AI agents via MCP. Full API v1.1 coverage.
The npm package @switchbot/openapi-cli receives a total of 678 weekly downloads. As such, @switchbot/openapi-cli popularity was classified as not popular.
We found that @switchbot/openapi-cli demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago.ย It has 4 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
/Research
Socket detected malicious node-ipc versions with obfuscated stealer/backdoor behavior in a developing npm supply chain attack.

Security News
TeamPCP and BreachForums are promoting a Shai-Hulud supply chain attack contest with a $1,000 prize for the biggest package compromise.

Security News
Packagist urges PHP projects to update Composer after a GitHub token format change exposed some GitHub Actions tokens in CI logs.