Welcome to Tesla Motors Club
Discuss Tesla's Model S, Model 3, Model X, Model Y, Cybertruck, Roadster and More.
Register

EV Car/My Tesla - An Alexa skill for Amazon Echo / Tesla integration

This site may earn commission on affiliate links.
I've created an Alexa skill that lets you monitor and control some Tesla functions using an Amazon Echo. You can get charge status, location & climate state. You can also control your car - flash lights, honk, start/stop charging, start/stop climate system and lock/unlock doors. This does not require setting up any servers and does not store the Tesla account credentials anywhere. A token is generated once and is used only by the Alexa services. If you already have a token, you can enter that directly.

To get started, go to your Echo and say "Alexa, enable EV Car". Now go the Alexa app on your phone or Amazon.com Sign In on your browser, click on the "Link Account" link and enter the Tesla account information.

Here's are some things you can say:
ask EV Car how far can I drive
ask EV Car for charge status
ask EV Car for car status
ask EV Car for climate status
tell EV Car to set driver temperature to 72
tell EV Car to set passenger side to 73
tell EV Car to to honk
tell EV Car to flash
tell EV Car to lock/unlock
tell EV Car to turn climate on/off
tell EV Car to start heating
tell EV Car to cool my car
tell EV Car to stop climate
ask EV Car how warm is my car
ask EV Car dude where's my car ask
tell EV Car to get ready to take off
tell EV Car to go into hyperdrive
 
Two questions:
* Since you chose the generic name "EV car" instead of something Tesla related, does this mean this skill is intended to work with other EVs too?
* Is this written as an Amazon Lambda function running on AWS or does this run on your own server some where else?
 
Two questions:
* Since you chose the generic name "EV car" instead of something Tesla related, does this mean this skill is intended to work with other EVs too?
* Is this written as an Amazon Lambda function running on AWS or does this run on your own server some where else?

* I am keeping that option open :) It currently only works with Teslas but if there are similar API for other EVs I could look into adding support for those.
* The backend is hosted on Amazon Lambda only. There are no other servers involved.
 
Not that I don't trust you, but I really hate to give out my Tesla credentials to a third party (Amazon). I realize you give the option to put a token which prevents the remote start, but from what I understand that is only good for 90 days which means re-configuring the skill as often. I wish Tesla would allow us to disable remote starting since all I do remotely is climate control and summon. I don't see a need to remote start since you still need a Wifi/Cell connection anyway which means I need my keys with me at all times. Also, the Apple Watch (Remote S) is awesome, so I am not sure how much I would use Alexa in this case anyway.

Can you briefly describe how secure the credentials would be? Can you walk us through the process?
 
Not that I don't trust you, but I really hate to give out my Tesla credentials to a third party (Amazon). I realize you give the option to put a token which prevents the remote start, but from what I understand that is only good for 90 days which means re-configuring the skill as often. I wish Tesla would allow us to disable remote starting since all I do remotely is climate control and summon. I don't see a need to remote start since you still need a Wifi/Cell connection anyway which means I need my keys with me at all times. Also, the Apple Watch (Remote S) is awesome, so I am not sure how much I would use Alexa in this case anyway.

Can you briefly describe how secure the credentials would be? Can you walk us through the process?

Its good to be a little paranoid about security. You don't know me so you have no reason to trust me (or not) :) I don't feel comfortable giving out my login information too which is why I built in the option to provide a token (instead of email/password). That alleviates the problem to some extent. I think having a token expire after 90 days is a good thing. It prevents the scenario of a long-forgotten apps continuing to access your information. I wish Tesla would provide full OAUTH web interface for applications or at least a provide a secure web page for generating tokens. Then there would be no need for apps to ask for email/passwords.

In terms of implementation details of handling that information in this Alexa skill - it relies on Amazon AWS Lambda entirely. I didn't want to get into saving and securing credentials so they are not stored anywhere. During account linking, the Alexa app opens a secure HTTPS connection to the Lambda function. The credentials/token are transferred using that channel. The token is either generated using the credentials or passed through The token is then cached by Amazon's Alexa backend infrastructure. If the email/password was provided, it is used only to generate the token and not stored at all. Tokens are invalidated by Tesla either when user changes their password or in 90 days. When that happens, the skill will redirect the user to the Alexa app to relink a new token.

Since there are no third party servers involved, the security of the token is as secure as Amazon AWS infrastructure is - which I would assume to be quite high. I don't know of any way that a cached token can be recovered. In the end its up to the end users to decide how they want to balance their use case with potential security issues. Everybody has different use cases. Initially I didn't see myself using the Echo at all but turns out that it gets used quite often now. For me this was initially a cool project to work on and made a nice demo for visitors. Now there are just two frequently used scenarios:

1. Get up in the middle of the night wondering if the charger is plugged in:
"Alexa, ask EV Car for battery status" - It speaks battery level, range, plugged-in status and scheduled charge start time.

2. In the morning while eating breakfast:
"Alexa, ask EV Car to start heating" - and we have a cozy car ready to take the kids to school.
 
Its good to be a little paranoid about security. You don't know me so you have no reason to trust me (or not) :) I don't feel comfortable giving out my login information too which is why I built in the option to provide a token (instead of email/password). That alleviates the problem to some extent. I think having a token expire after 90 days is a good thing. It prevents the scenario of a long-forgotten apps continuing to access your information. I wish Tesla would provide full OAUTH web interface for applications or at least a provide a secure web page for generating tokens. Then there would be no need for apps to ask for email/passwords.

In terms of implementation details of handling that information in this Alexa skill - it relies on Amazon AWS Lambda entirely. I didn't want to get into saving and securing credentials so they are not stored anywhere. During account linking, the Alexa app opens a secure HTTPS connection to the Lambda function. The credentials/token are transferred using that channel. The token is either generated using the credentials or passed through The token is then cached by Amazon's Alexa backend infrastructure. If the email/password was provided, it is used only to generate the token and not stored at all. Tokens are invalidated by Tesla either when user changes their password or in 90 days. When that happens, the skill will redirect the user to the Alexa app to relink a new token.

Since there are no third party servers involved, the security of the token is as secure as Amazon AWS infrastructure is - which I would assume to be quite high. I don't know of any way that a cached token can be recovered. In the end its up to the end users to decide how they want to balance their use case with potential security issues. Everybody has different use cases. Initially I didn't see myself using the Echo at all but turns out that it gets used quite often now. For me this was initially a cool project to work on and made a nice demo for visitors. Now there are just two frequently used scenarios:

1. Get up in the middle of the night wondering if the charger is plugged in:
"Alexa, ask EV Car for battery status" - It speaks battery level, range, plugged-in status and scheduled charge start time.

2. In the morning while eating breakfast:
"Alexa, ask EV Car to start heating" - and we have a cozy car ready to take the kids to school.

Thanks for the detailed explanation. I am in the Cybersecurity industry, so it's my job to be paranoid! You are correct, it is only as secure as AWS's environment. That being said, AWS takes security extremely seriously. I have met their CSO before and grilled him quite extensively when one of my former companies was a decent sized customer. They really have a solid security program with segregation of duties, etc. To date, I am not aware of any breaches they have had, but sometimes breaches don't get disclosed to the public.

Can summon be added to your skill? That would probably be my biggest use case as every morning, I do that.
 
  • Like
Reactions: EVie'sDad and Gol4
We have two vehicles on one account (S, X). How do we differentiate between them?

This is an item on the todo list. Right now it fill use the first car found on the account. Some commands speak the "name" of the car so you know which one its talking to. The challenge is to figure out the spoken interaction with Alexa that allows the user to select a vehicle and being able to maintain that selection between multiple spoken commands. I can work on this once the current version has stabilized.
 
  • Helpful
Reactions: Fiddler
...
Can summon be added to your skill? That would probably be my biggest use case as every morning, I do that.

There is no summon support for now for a number of reasons:
  • My only test subject is a new X with AP2/HW2. I have never seen the fabled summon feature in action so cannot test/implement it :)
  • This project is still in infancy, I don't know if I want to do something as drastic as moving a car at this stage. We could do that after building confidence in this workflow.
  • The summon feature seems to use the streaming API that I do not know much about yet.
  • The summon feature seems to require providing the email address in the API. The current design of this skill doesn't save the email address so its not available.