Skip to main content

Integrate with Home Assistant

Support level: Community

What is Home Assistant?​

Open source home automation that puts local control and privacy first. Powered by a worldwide community of tinkerers and DIY enthusiasts. Perfect to run on a Raspberry Pi or a local server.

-- https://www.home-assistant.io/

Preparation​

The following placeholders are used in this guide:

  • hass.company is the FQDN of the Home Assistant installation.
  • authentik.company is the FQDN of the authentik installation.
info

This documentation lists only the settings that you need to change from their default values. Be aware that any changes other than those explicitly mentioned in this guide could cause issues accessing your application.

Home Assistant does not include built-in support for SSO protocols. This guide covers two community-maintained OpenID Connect integrations:

Choose one integration before continuing, then use the matching tab in the authentik and Home Assistant configuration sections.

authentik configuration​

Redirect URI changes in authentik 2026.5

In authentik versions earlier than 2026.5, all Redirect URIs are automatically treated as Authorization type. If you are using one of these older authentik versions, add only the Authorization URL to your Redirect URIs and do not configure a Post Logout URI.

To support the integration of Home Assistant with authentik, you need to create an application/provider pair in authentik.

Create an application and provider​

  1. Log in to authentik as an administrator and open the authentik Admin interface.
  2. Navigate to Applications > Applications and click New Application to open the application wizard.
    • Application: provide a descriptive name, an optional group for the type of application, the policy engine mode, and optional UI settings. Note the application Slug because you will use it later as <application_slug>.
    • Choose a Provider type: select OAuth2/OpenID Connect as the provider type.
    • Configure the Provider: provide a name (or accept the auto-provided name), the authorization flow to use for this provider, and the following required configurations.
      • Note the Client ID and Client Secret values because they will be required later.
      • Add a Redirect URI of type Strict Authorization as https://hass.company/auth/oidc/callback.
      • Set Signing Key to any available signing key.
    • Configure Bindings (optional): you can create a binding (policy, group, or user) to manage the listing and access to applications on a user's Application Dashboard page.
  3. Click Submit to save the new application and provider.

Home Assistant configuration​

UI configuration​

  1. Install OpenID Connect/SSO Authentication from HACS.
  2. Restart Home Assistant if HACS asks you to do so.
  3. Log in to Home Assistant as an administrator and go to Settings > Devices & Services.
  4. Click Add Integration and select OpenID Connect/SSO Authentication.
  5. Select the authentik provider from the pre-configured providers.
  6. Set Discovery URL to https://authentik.company/application/o/<application_slug>/.well-known/openid-configuration.
  7. Continue after Home Assistant successfully validates the discovery URL.
  8. Enter the Client ID and Client Secret from authentik.
  9. Configure the group and user-linking options for your Home Assistant deployment, then finish the setup.
Temporary user linking only

Only enable automatic user linking while migrating existing Home Assistant users to OIDC. Disable it again after the users are linked.

YAML configuration​

To configure the integration with YAML instead of the Home Assistant UI, add the following to your Home Assistant configuration:

/config/configuration.yaml
auth_oidc:
    client_id: <Client ID from authentik>
    client_secret: !secret authentik_client_secret
    discovery_url: "https://authentik.company/application/o/<application_slug>/.well-known/openid-configuration"

Restart Home Assistant after changing configuration.yaml. For advanced options, such as role mapping, user linking, TLS settings, and public-client configuration, refer to the hass-oidc-auth YAML configuration guide linked in the resources section.

Configuration verification​

To confirm that authentik is properly configured with Home Assistant, open Home Assistant and start an SSO login with the integration you configured. You should be redirected to authentik and then back to Home Assistant after successful authentication.

Resources​