Good, that’s the same setup we use for a few signal lamps. Three pieces:

1. Device profile of the relay, Commands tab: add a command light.set, tier Basic, one parameter on of type Yes / no. Tier matters, because an API key can only send methods that are in the profile’s catalog.
2. Firmware: subscribe to v1/rpc/req/+, switch GPIO12 (the relay on the Basic R2), answer on the same id, and report the new state.

void onMsg(char* topic, byte* p, unsigned int n) {
  // topic: v1/rpc/req/42
  String id = String(topic).substring(11);
  StaticJsonDocument<128> d; deserializeJson(d, p, n);
  bool on = d["params"]["on"];
  digitalWrite(12, on ? HIGH : LOW);
  mqtt.publish(("v1/rpc/res/" + id).c_str(), "{"ok":true}");
  mqtt.publish("v1/telemetry", on ? "{"relay":1}" : "{"relay":0}");
}

1. Your script: an API key from API Keys (Developer menu) with only what it needs. The send route wants iot_rpc.read plus the tier’s permission, so tick those two and nothing else, fill the IP allowlist with the lab PC’s address and keep the 90-day expiry.

import requests
r = requests.post(
    f"https://{HOST}/tenant/{TENANT}/api/iot/devices/{DEVICE}/rpc",
    headers={"Authorization": f"Bearer {KEY}"},
    json={"method": "light.set", "params": {"on": True}, "timeoutMs": 10000},
)
print(r.status_code, r.json()["rpc"]["status"])

A two-way command with a timeout of 30 s or less waits and comes back 200 with SUCCESSFUL. Reference: Commands API

The ESP8266 does TLS, but memory is tight; use BearSSL with smaller buffers if the connect fails.