---
title: "OpenID / OAuth2 authentication"
description: "OpenID / OAuth2 authentication is a Marketplace integration for Home Assistant. It has 543 installs sharing analytics, needs the vendor's cloud and was last updated October 10, 2026."
canonical: "https://vulpo.app/integrations/marketplace/cavefire-hass-openid"
url: "https://vulpo.app/integrations/marketplace/cavefire-hass-openid.md"
last-updated: "2026-10-22"
version: "1.4"
---

# OpenID / OAuth2 authentication

> OpenID / OAuth2 authentication is a Marketplace integration for Home Assistant. It has 543 installs sharing analytics, needs the vendor's cloud and was last updated October 10, 2026.

OpenID / OAuth2 authentication lets Home Assistant sign users in through an OpenID Connect identity provider. It uses the authorization code flow and plugs into the built-in Home Assistant login system, adding a provider button to the login page with configurable text. Provider endpoints can come from a discovery URL or be entered by hand, with optional PKCE and a choice of whether to verify the provider's TLS certificate. Identity mapping covers the requested scope and which claim becomes the Home Assistant username, such as preferred username or email. Advanced options can create Home Assistant users automatically on first sign-in, block other login methods except from trusted IPv4 or IPv6 ranges, and send extra authorization parameters. It is set up through the Home Assistant UI and depends on the vendor's cloud.

Automatic summary of the README and code of cavefire/hass-openid. Something wrong, or are you the maintainer and want your own text here? [Get in touch](https://vulpo.app/contact)

[Open in My Home Assistant](https://my.home-assistant.io/redirect/hacs_repository/?owner=cavefire&repository=hass-openid&category=integration)

On Home Assistant 2026.11 or newer? [Open it in the Marketplace](https://my.home-assistant.io/redirect/marketplace_repository/?owner=cavefire&repository=hass-openid&category=integration)

## Supports

- **Uses the vendor's cloud**: Needs an internet connection and an account with the vendor.
- **From the Marketplace**: Installed through the Marketplace, formerly HACS.
- **Actively maintained**: Its author released or pushed a change in the last six months.

## Setting it up

Install it from the Marketplace and restart Home Assistant, then add it under Settings, Devices and services.

### Sign in

- **Client ID**: OAuth2/OpenID client ID for Home Assistant
- **Client secret**: OAuth2/OpenID client secret for Home Assistant

### Advanced

- **Block other login methods**: Only allow OpenID login unless the client IP matches one of the trusted IPv4 or IPv6 CIDR blocks below
- **Create Home Assistant users automatically**: Automatically create a Home Assistant user the first time someone signs in
- **Custom error redirect URL**: Optional URL to redirect to instead of showing the built-in OpenID error page
- **Login button text**: Text shown on the Home Assistant login page
- **Trusted IPv4/IPv6 CIDR blocks**: Enter one IPv4 or IPv6 CIDR block per line
- **Use HTTP Basic auth for the token request**: Send the client ID and secret in the Authorization header when exchanging the code for tokens
- **Custom authorize parameters**: Optional extra parameters for the provider's authorization request, one key=value per line (for example hd=example.com)

### Discovery

- **Configure URL**: Discovery endpoint, usually the provider's OpenID configuration URL
- **Validate TLS certificate**: Verify the provider TLS certificate when fetching the discovery document

### Identity

- **Requested scope**: OAuth2/OpenID scope to request from the provider
- **Username field**: Claim to use as the Home Assistant username, for example preferred\_username or email

### Provider

- **Authorization endpoint**: Authorization endpoint
- **Logout endpoint**: Optional logout endpoint
- **Token endpoint**: Token endpoint
- **Use PKCE**: Whether the authorization flow should use PKCE
- **User info endpoint**: User info endpoint
- **Validate TLS certificate**: Verify the provider TLS certificate for discovery, token, and user info requests

Texts from the code of [cavefire/hass-openid](https://github.com/cavefire/hass-openid).

## From the README

> This integration allows Home Assistant to authenticate users via an OpenID Connect (OIDC) provider. It supports the authorization code flow and integrates seamlessly with Home Assistant's authentication system.

From the README of [cavefire/hass-openid](https://github.com/cavefire/hass-openid#readme), [GNU GPL v3.0](https://spdx.org/licenses/GPL-3.0.html). Shortened.

## At a glance

- Kind: Marketplace integration
- Number: 543 installs sharing analytics; 214 GitHub stars
- Connection: Needs the vendor's cloud
- Upkeep: Updated in the last 6 months
- Needs: Needs the Marketplace (HACS on 2026.10 and older)
- Latest version: 1.4.0, last updated October 10, 2026
- Domain: `openid`
- Source: <https://github.com/cavefire/hass-openid>
- Issues: <https://github.com/cavefire/hass-openid/issues>

Independent directory, made by the developer of Vulpo. Not affiliated with Home Assistant or the Open Home Foundation. [About these numbers](https://vulpo.app/integrations/about)

Last updated 2026-10-22. Source: https://vulpo.app/integrations/marketplace/cavefire-hass-openid

---

- HTML version of this page: https://vulpo.app/integrations/marketplace/cavefire-hass-openid
- Site index for agents: https://vulpo.app/llms.txt
- Everything in one document: https://vulpo.app/llms-full.txt
- All pages: https://vulpo.app/sitemap.xml