OpenID / OAuth2 authentication for Home Assistant (Marketplace integration)

Installs: 543 sharing analytics
GitHub stars: 214
Connection: Uses the vendor's cloud
Upkeep: Updated in the last 6 months
Version: 1.4.0, October 10, 2026
Kind: Marketplace integration
Needs: Needs the Marketplace (HACS on 2026.10 and older)
Domain: openid
Source: github.com/cavefire/hass-openid
Issues: Report an issue

Independent directory, made by the developer of Vulpo. Not affiliated with Home Assistant or the Open Home Foundation.

About

OpenID / OAuth2 authentication lets Home Assistant sign users in through an OpenID Connect identity provider. It uses the authorization code flow and plugs into the built-in Home Assistant login system, adding a provider button to the login page with configurable text. Provider endpoints can come from a discovery URL or be entered by hand, with optional PKCE and a choice of whether to verify the provider's TLS certificate. Identity mapping covers the requested scope and which claim becomes the Home Assistant username, such as preferred username or email. Advanced options can create Home Assistant users automatically on first sign-in, block other login methods except from trusted IPv4 or IPv6 ranges, and send extra authorization parameters. It is set up through the Home Assistant UI and depends on the vendor's cloud.

Automatic summary of the README and code of cavefire/hass-openid. Something wrong, or are you the maintainer and want your own text here? Get in touch

Supports

Uses the vendor's cloud Needs an internet connection and an account with the vendor.
From the Marketplace Installed through the Marketplace, formerly HACS.
Actively maintained Its author released or pushed a change in the last six months.

Setting it up

Install it from the Marketplace and restart Home Assistant, then add it under Settings, Devices and services.

Sign in

Client IDOAuth2/OpenID client ID for Home Assistant
Client secretOAuth2/OpenID client secret for Home Assistant

Advanced

Block other login methodsOnly allow OpenID login unless the client IP matches one of the trusted IPv4 or IPv6 CIDR blocks below
Create Home Assistant users automaticallyAutomatically create a Home Assistant user the first time someone signs in
Custom error redirect URLOptional URL to redirect to instead of showing the built-in OpenID error page
Login button textText shown on the Home Assistant login page
Trusted IPv4/IPv6 CIDR blocksEnter one IPv4 or IPv6 CIDR block per line
Use HTTP Basic auth for the token requestSend the client ID and secret in the Authorization header when exchanging the code for tokens
Custom authorize parametersOptional extra parameters for the provider's authorization request, one key=value per line (for example hd=example.com)

Discovery

Configure URLDiscovery endpoint, usually the provider's OpenID configuration URL
Validate TLS certificateVerify the provider TLS certificate when fetching the discovery document

Identity

Requested scopeOAuth2/OpenID scope to request from the provider
Username fieldClaim to use as the Home Assistant username, for example preferred_username or email

Provider

Authorization endpointAuthorization endpoint
Logout endpointOptional logout endpoint
Token endpointToken endpoint
Use PKCEWhether the authorization flow should use PKCE
User info endpointUser info endpoint
Validate TLS certificateVerify the provider TLS certificate for discovery, token, and user info requests

Texts from the code of cavefire/hass-openid.

From the README

This integration allows Home Assistant to authenticate users via an OpenID Connect (OIDC) provider. It supports the authorization code flow and integrates seamlessly with Home Assistant's authentication system.

From the README of cavefire/hass-openid, GNU GPL v3.0. Shortened.