How to generate a 9-digit OTPC for the thread network? #12266

jadero · 2026-01-06T10:42:22Z

jadero
Jan 6, 2026

Hi there, I want my Ikea Dirigera Hub to join my Thread network. For this the Dirigera hub needs a 9-digit key for the Thread network to join. How can I generate such code for my OpenThread based network? Is this even supported? I am using the official openthread/border-router docker image btw. Thanks.

Answered by abtink

Jan 6, 2026

By the way, there is currently no CLI command corresponding to the otBorderAgentEphemeralKeyValidateTap or otBorderAgentEphemeralKeyGenerateTap APIs.

This is currently being worked on, e.g, see:

#12037

Edit:
Submitted the following PR for CLI support:

#12267

View full answer

abtink · 2026-01-06T18:44:04Z

abtink
Jan 6, 2026
Collaborator

OpenThread core provides APIs to generate or validate a cryptographically secure random Thread Administration One-Time Passcode (TAP) string.

See these APIs:

openthread/include/openthread/border_agent_ephemeral_key.h

Lines 228 to 259 in bcc41e9

 
 /** 

  * Generates a cryptographically secure random Thread Administration One-Time Passcode (TAP) string. 

  * 

  * Requires `OPENTHREAD_CONFIG_BORDER_AGENT_EPHEMERAL_KEY_ENABLE` and `OPENTHREAD_CONFIG_VERHOEFF_CHECKSUM_ENABLE`. 

  * 

  * The TAP is a string of 9 characters, generated as a sequence of eight cryptographically secure random 

  * numeric digits [`0`-`9`] followed by a single check digit determined using the Verhoeff algorithm. 

  * 

  * @param[out] aTap         A pointer to an `otBorderAgentEphemeralKeyTap` to output the generated TAP. 

  * 

  * @retval OT_ERROR_NONE    Successfully generated a random TAP. @p aTap is updated. 

  * @retval OT_ERROR_FAILED  Failed to generate a random TAP. 

  */ 

 otError otBorderAgentEphemeralKeyGenerateTap(otBorderAgentEphemeralKeyTap *aTap); 

 /** 

  * Validates a given Thread Administration One-Time Passcode (TAP) string. 

  * 

  * Requires `OPENTHREAD_CONFIG_BORDER_AGENT_EPHEMERAL_KEY_ENABLE` and `OPENTHREAD_CONFIG_VERHOEFF_CHECKSUM_ENABLE`. 

  * 

  * Validates that the TAP string has the proper length, contains digit characters [`0`-`9`], and validates the 

  * Verhoeff checksum. 

  * 

  * @param[in] aTap     The `otBorderAgentEphemeralKeyTap` to validate. 

  * 

  * @retval OT_ERROR_NONE            Successfully validated the @p aTap. 

  * @retval OT_ERROR_INVALID_ARGS    The @p aTap string has an invalid length or contains non-digit characters. 

  * @retval OT_ERROR_FAILED          Checksum validation failed. 

  */ 

 otError otBorderAgentEphemeralKeyValidateTap(const otBorderAgentEphemeralKeyTap *aTap);

In addition, it provides helper APIs for the Verhoeff checksum (which is used by TAP).

openthread/include/openthread/verhoeff_checksum.h

Lines 55 to 87 in bcc41e9

 /** 

  * Specifies the maximum length of decimal string input in `otVerhoeffChecksum` functions. 

  */ 

 #define OT_VERHOEFF_CHECKSUM_MAX_STRING_LENGTH 128 

 /** 

  * Calculates the Verhoeff checksum for a given decimal string. 

  * 

  * Requires `OPENTHREAD_CONFIG_VERHOEFF_CHECKSUM_ENABLE`. 

  * 

  * @param[in]  aDecimalString   The string containing decimal digits. 

  * @param[out] aChecksum        Pointer to a `char` to return the calculated checksum. 

  * 

  * @retval OT_ERROR_NONE            Successfully calculated the checksum, @p aChecksum is updated. 

  * @retval OT_ERROR_INVALID_ARGS    The @p aDecimalString is not valid, i.e. it either contains chars other than 

  *                                  ['0'-'9'], or is longer than `OT_VERHOEFF_CHECKSUM_MAX_STRING_LENGTH`. 

  */ 

 otError otVerhoeffChecksumCalculate(const char *aDecimalString, char *aChecksum); 

 /** 

  * Validates the Verhoeff checksum for a given decimal string. 

  * 

  * Requires `OPENTHREAD_CONFIG_VERHOEFF_CHECKSUM_ENABLE`. 

  * 

  * @param[in] aDecimalString   The string containing decimal digits (last char is treated as checksum). 

  * 

  * @retval OT_ERROR_NONE            Successfully validated the checksum in @p aDecimalString. 

  * @retval OT_ERROR_FAILED          Checksum validation failed. 

  * @retval OT_ERROR_INVALID_ARGS    The @p aDecimalString is not valid, i.e. it either contains chars other than 

  *                                  ['0'-'9'], or is longer than `OT_VERHOEFF_CHECKSUM_MAX_STRING_LENGTH`. 

  */ 

 otError otVerhoeffChecksumValidate(const char *aDecimalString);

Whether a project or product (which integrated OpenThread) uses these APIs or implements its own TAP generation, and whether/how it exposes this to the user, is up to the project- or product-specific application layer implementation.

7 replies

abtink Jan 6, 2026
Collaborator

By the way, there is currently no CLI command corresponding to the otBorderAgentEphemeralKeyValidateTap or otBorderAgentEphemeralKeyGenerateTap APIs.

This is currently being worked on, e.g, see:

[cli] Added CLI to generate one time passcode #12037

Edit:
Submitted the following PR for CLI support:

[cli] add commands for ephemeral key TAP generation and validation #12267

Answer selected by jadero

3oris Jan 6, 2026

@abtink , with your #12267 , does that mean we can

ba ephemeralkey generate-tap
989710128
Done
ba ephemeralkey start 989710128 4000
Done

let the IKEA hub know the 989710128, and that's it?

abtink Jan 6, 2026
Collaborator

Yes. I expect such a flow to work.

jadero Jan 14, 2026
Author

Latest docker image now includes the PR.
~~I followed the procedure exactly like @3oris wrote but sadly it is not working. The Ikea Home Smart app simply states that it is not able to join the Thread network.~~
I tried with a longer timeout and now it worked!

jwhui Jan 14, 2026
Maintainer

@jadero , thanks for testing and reporting back!

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

OpenThread

How to generate a 9-digit OTPC for the thread network? #12266

Uh oh!

{{title}}

Uh oh!

Replies: 1 comment 7 replies

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{editor}}'s edit

{{editor}}'s edit

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Uh oh!

{{title}}

Uh oh!

Select a reply

Uh oh!

OpenThread

How to generate a 9-digit OTPC for the thread network? #12266

Uh oh!

jadero Jan 6, 2026

Replies: 1 comment · 7 replies

Uh oh!

abtink Jan 6, 2026 Collaborator

Uh oh!

Uh oh!

abtink Jan 6, 2026 Collaborator

Uh oh!

3oris Jan 6, 2026

Uh oh!

abtink Jan 6, 2026 Collaborator

Uh oh!

jadero Jan 14, 2026 Author

Uh oh!

jwhui Jan 14, 2026 Maintainer

jadero
Jan 6, 2026

Replies: 1 comment 7 replies

abtink
Jan 6, 2026
Collaborator

abtink Jan 6, 2026
Collaborator

abtink Jan 6, 2026
Collaborator

jadero Jan 14, 2026
Author

jwhui Jan 14, 2026
Maintainer