Good, that’s the same setup we use for a few signal lamps. Three pieces:
- Device profile of the relay, Commands tab: add a command
light.set, tier Basic, one parameteronof type Yes / no. Tier matters, because an API key can only send methods that are in the profile’s catalog. - Firmware: subscribe to
v1/rpc/req/+, switch GPIO12 (the relay on the Basic R2), answer on the same id, and report the new state.
void onMsg(char* topic, byte* p, unsigned int n) {
// topic: v1/rpc/req/42
String id = String(topic).substring(11);
StaticJsonDocument<128> d; deserializeJson(d, p, n);
bool on = d["params"]["on"];
digitalWrite(12, on ? HIGH : LOW);
mqtt.publish(("v1/rpc/res/" + id).c_str(), "{"ok":true}");
mqtt.publish("v1/telemetry", on ? "{"relay":1}" : "{"relay":0}");
}
- Your script: an API key from API Keys (Developer menu) with only what it needs. The send route wants
iot_rpc.readplus the tier’s permission, so tick those two and nothing else, fill the IP allowlist with the lab PC’s address and keep the 90-day expiry.
import requests
r = requests.post(
f"https://{HOST}/tenant/{TENANT}/api/iot/devices/{DEVICE}/rpc",
headers={"Authorization": f"Bearer {KEY}"},
json={"method": "light.set", "params": {"on": True}, "timeoutMs": 10000},
)
print(r.status_code, r.json()["rpc"]["status"])
A two-way command with a timeout of 30 s or less waits and comes back 200 with SUCCESSFUL. Reference: Commands API
The ESP8266 does TLS, but memory is tight; use BearSSL with smaller buffers if the connect fails.

