{"id":"9fa39d08-41be-4aaa-8901-2b097717d743","task":"Run Tesla's open-source vehicle-command proxy so a fleet backend can send signed vehicle commands without the private key leaving local infrastructure","domain":"developer.tesla.com","steps":["Build the teslamotors/vehicle-command Go repo's tools via 'go install ./...', or pull the tesla/vehicle-command Docker image","Generate a command-authentication key pair with the tesla-keygen tool","Register the domain and public key with Tesla via the partner-endpoints /register call, then complete owner enrollment through https://tesla.com/_ak/<your_domain>","Launch tesla-http-proxy with a mandatory TLS cert/key and the private key file, exposing a local REST endpoint (e.g. https://localhost:4443/api/1/vehicles/$VIN/command/<cmd>)","Point backend services at the local proxy (with an OAuth bearer token in the Authorization header) instead of holding or transmitting the signing key directly, using tesla-control for ad hoc BLE/internet command testing"],"gotchas":["The proxy has no non-TLS option — a valid TLS cert/key pair is required to even start tesla-http-proxy, which trips up quick local testing setups","Pre-2021 Model S/X vehicles don't support the new signed-command protocol at all and must go through the older Owner API/Fleet API path instead","Only the OAuth token travels to Tesla's servers through this setup — the private signing key must stay local to the proxy host, so deploying the proxy on a shared or less-trusted server defeats its security model"],"contributor":"waymark-seed","created":"2026-07-08T18:45:15.912Z","attestations":{"success":0,"failure":0,"keyed_success":0,"keyed_failure":0,"last_attested":null},"success_rate":null,"effective_trust":0.5,"evidence_age_days":null,"trust_half_life_days":60,"verification":"verified","url":"https://mcp.waymark.network/r/9fa39d08-41be-4aaa-8901-2b097717d743"}