Mysa Consumer API: Troubleshooting

Last updated: November 14, 2026

This guide covers common issues when running the public examples at github.com/empoweredhomes/mysa-api-examples.

Before you start

  • Use the latest code from the public examples repo.

  • Confirm your app’s redirect URI matches the URI registered for your integration exactly, including protocol, path, and trailing slash.

  • Use OAuth 2.0 Authorization Code with PKCE. Do not share your Mysa password, access token, refresh token, client secret, or other credentials with support.

  • Store tokens securely and rotate or revoke them if they may have been exposed.

Authentication or sign-in fails

Symptoms: You cannot complete sign-in, the browser returns an authorization error, or the example app never receives the callback.

What to check:

  • The redirect URI in your local example matches the registered redirect URI exactly.

  • Your local server is running and listening on the same host and port used in the redirect URI.

  • You are using the PKCE flow from the example and not sending passwords directly to the API.

  • Your browser is not blocking the callback or opening it in a different profile where the local app is unavailable.

If you contact support, include: the app name, your developer email, the redirect URI you are using, the step where it fails, and any non-sensitive error text. Do not include passwords, access tokens, refresh tokens, client secrets, or authorization codes.

No devices are returned

Symptoms: Authentication succeeds, but the API response contains no thermostats or the expected thermostat is missing.

What to check:

  • The Mysa account you signed in with is the same account that owns or has access to the thermostat in the Mysa app.

  • The thermostat is visible in the Mysa mobile app.

  • The integration is requesting the correct access for the device data you are trying to read.

Requests return unauthorized or forbidden errors

Symptoms: API calls return 401, 403, or an authorization-related error after sign-in.

What to check:

  • Your access token has not expired. If it has, use the refresh flow from the examples.

  • You are sending the token in the expected authorization header.

  • The account used for sign-in has access to the thermostat or resource you are requesting.

  • You are not using a token copied from a different environment or user.

Control commands do not appear to work

Symptoms: A command request appears successful, but the thermostat does not change as expected.

What to check:

  • The target device ID is correct.

  • The thermostat is online in the Mysa app.

  • The command is valid for that thermostat type and mode.

  • You have allowed time for the thermostat and app to sync.

Rate limits, repeated failures, or unexpected responses

If your app is making repeated requests or receiving unexpected API responses, slow down retries and log the non-sensitive details needed for investigation: endpoint, timestamp, HTTP status, request method, and the sanitized response body.

Security issues

If you believe an access token, refresh token, authorization code, or other credential has been exposed, stop using it and contact Mysa Support right away. Do not paste the token into the support conversation. Tell us that a token may have been exposed and which app or integration was involved.

What to send support

To help us investigate quickly, send:

  • App or integration name

  • Developer name and email

  • Redirect URI(s), copied exactly

  • Which example you are running, such as curl, Python, or TypeScript

  • What you expected to happen

  • What actually happened

  • HTTP status code and non-sensitive error text

  • Approximate timestamp and timezone

Never send your Mysa password, access token, refresh token, client secret, authorization code, or any other credential.