Everything about setup, privacy, and how the app works.
Three reasons:
Privacy — Your Tesla credentials are never shared with anyone, not even the app developer. The connection is directly between your phone and Tesla's servers.
Cost — Tesla gives every developer account a $10/month credit toward API usage. Your personal use costs well under $1/month, so the credit covers it easily. If the app used a single shared account, the per-call costs from all users would fall on the developer.
Control — You can revoke access, change permissions, or delete your developer app anytime at developer.tesla.com.
Not for personal use. Tesla charges per API call (roughly $0.001 per command, $0.002 per data request, $0.02 per wake-up), but every developer account gets a $10/month credit applied automatically. Normal personal use — locking, unlocking, checking status a few times a day — costs well under $1/month, so the credit covers it easily. No payment method is required to get started.
A shared app would compromise both privacy and cost.
Privacy: With a shared developer account, every user's sign-in would need to route through a server — meaning Tesla authorization codes and tokens would temporarily pass through infrastructure outside your control. With your own account, the token exchange happens directly between your phone and Tesla. Nothing passes through any intermediary.
Cost: Tesla charges developers per API call. Every account gets a $10/month credit that easily covers one person's use. But with many users on a single account, those per-call costs add up quickly and would fall on the app developer. With your own account, your usage stays within your own $10 credit — no cost to you or anyone else.
Usually a few minutes, though it can occasionally take longer. You'll see the status on your developer.tesla.com dashboard.
Tesla requires every developer app to have an Allowed Origin and Allowed Redirect URI. These are part of the OAuth standard — the secure sign-in process used by Tesla, Google, Apple, and most major services.
Think of them like a return address on an envelope. When you sign in, Tesla checks that the request is coming from the website listed in your developer app. If it doesn't match, Tesla rejects the sign-in. This prevents someone from impersonating your app.
Your credentials never pass through that website. The sign-in happens directly between your Light Phone and Tesla's servers. The website URL is only used by Tesla as a verification check.
The Allowed Origin and Redirect URI must match what the app sends to Tesla during sign-in. The app is built with tesla-lightphone.app as its redirect — so your developer app needs to list the same URL. If they don't match exactly, Tesla rejects the sign-in.
This doesn't give the website access to anything. The website is a static page with no backend — it can't receive, store, or process your credentials. The URL is purely a label that Tesla uses to verify the request.
When creating your developer app at developer.tesla.com, set:
Allowed Origin:
https://tesla-lightphone.app
Allowed Redirect URI:
https://tesla-lightphone.app/setup
These must match exactly — including https:// and no trailing slash on the origin.
Scopes are the permissions you grant the app when you sign in with Tesla. Each scope controls what the app can and cannot do. You choose which scopes to enable when creating your developer app — and you can change them later.
| Scope | What It Does | Required? |
|---|---|---|
| Vehicle Information | Read your car's current state: battery level, charge status, interior/exterior temperature, location, tire pressure, odometer, and whether doors/windows are open. This is how the app shows your vehicle's status screen. | Yes |
| Vehicle Commands | Send commands to your car: lock/unlock doors, turn climate on/off, open trunk and frunk, toggle sentry mode, flash lights, honk horn, vent or close windows, and remote start. This is the core of what the app does. | Yes |
| Vehicle Charging Management | Manage charging: start or stop a charging session, set the charge limit percentage, open or close the charge port, and schedule charging times. | Optional |
Vehicle Information and Vehicle Commands are needed for the app to function. Vehicle Charging Management is optional — you can add it later from your developer dashboard if you want charging controls.
Yes. Go to developer.tesla.com, edit your application, and update the scope checkboxes. After changing scopes, you'll need to disconnect and reconnect in the app so the new permissions take effect.
These are standard OAuth scopes that Tesla handles automatically — you don't select them on the developer dashboard. openid identifies your account during sign-in, and offline_access lets the app refresh its access token without asking you to sign in again every time. These don't grant any extra access to your vehicle.
The QR code is generated entirely by JavaScript running in your browser. No network requests are made with your credentials — they never leave your screen until your phone's camera reads the code.
You can verify this yourself:
1. Open the source code on GitHub and search for the generateQR() function — it's all client-side.
2. Open your browser's Network tab (right-click → Inspect → Network) before entering credentials. You'll see zero outgoing requests when you generate the QR code.
3. Disconnect from the internet entirely before entering your credentials. The QR code still generates — proving nothing is sent anywhere.
Yes. You can generate it from your computer's terminal, completely offline:
Mac (install qrencode via Homebrew first):
brew install qrencode
qrencode -o tesla-qr.png '{"t":"cred","i":"YOUR_CLIENT_ID","s":"YOUR_CLIENT_SECRET"}'
This creates a tesla-qr.png file. Open it, scan with your Light Phone, then delete the file.
Windows (using Python):
pip install qrcode[pil]
python -c "import qrcode; qrcode.make('{\"t\":\"cred\",\"i\":\"YOUR_CLIENT_ID\",\"s\":\"YOUR_CLIENT_SECRET\"}').save('tesla-qr.png')"
Or skip the QR entirely and type your credentials directly into the app using manual entry.
If you get an error after signing in, go to Settings in the app and tap Disconnect. Then re-enter your credentials (by QR or manually) and try again.
A common issue: uppercase I and lowercase l look identical on the Light Phone screen. If manual entry isn't working, double-check these characters in your Client Secret.
After signing in, the app asks to pair an encryption key with your vehicle. Tesla requires all third-party apps to use end-to-end encrypted commands (Vehicle Command Protocol). This step authorizes the app to send those encrypted commands to your specific vehicle.
A QR code appears on the Light Phone screen. Scan it with your smartphone. This opens the Tesla app, which asks to approve the key for your vehicle. Once approved, tap CONTINUE on the Light Phone.
Yes. No server is involved in this step. The pairing happens directly between the app and Tesla. The encryption key is stored only in the app on your phone — it never leaves the device.
If you disconnect and reconnect in the app, you will need to go through the full setup including key pairing again. The key enrollment on your vehicle persists, but the app needs to confirm it.
Your Client ID, Client Secret, and OAuth tokens are stored in the app's private data store on your Light Phone. This storage is sandboxed by Android — no other app can access it. Nothing is stored on any server.
No. The app communicates only with Tesla's servers (auth.tesla.com for sign-in and fleet-api.prd.na.vn.cloud.tesla.com for vehicle commands). There is no intermediary server, no analytics, no tracking, and no background network activity.
Nothing. The setup page at tesla-lightphone.app is a static HTML file hosted on GitHub Pages. It has no backend, no database, no server-side code, and no analytics. Your credentials are processed entirely in your browser's memory and are gone when you close the tab.
Yes. Every line of code — the app, the setup website, and this FAQ — is public at github.com/mindfulpractice/tesla-lightphone. You can read, audit, or build the app from source yourself.
Two levels:
In the app: Go to Settings → Disconnect. This clears all tokens and credentials from the app. You'll need to sign in again to use it.
At Tesla: Go to developer.tesla.com and delete your developer application. This fully revokes all API access, and no app using those credentials can connect to your vehicle again.
Double-check the secret on developer.tesla.com. Watch for uppercase I vs lowercase l — they look identical on the Light Phone screen. If you used QR entry, try regenerating the code with the correct secret.
Make sure your Light Phone has internet access (Wi-Fi or cellular data). The sign-in page is hosted by Tesla at auth.tesla.com, not by this app.
Try signing in again. If it keeps failing, verify your Allowed Origin and Redirect URI in your developer app match exactly: https://tesla-lightphone.app and https://tesla-lightphone.app/setup.
This usually means the app's secure command channel (VCP) hasn't been set up yet. The app attempts this automatically during setup. Try disconnecting and reconnecting. If it persists, make sure your developer app is approved and your scopes include Vehicle Commands.
This is normal. Teslas go to sleep to save battery. Send any command and the car wakes up automatically — it takes a few seconds. Try the command again after a moment.
Download the latest APK from the GitHub releases page and install it on your Light Phone via ADB. Your credentials are preserved across updates — no need to sign in again.