// the take
A custom Home Assistant integration that replaces or augments HA's built-in login with a full OpenID Connect client, letting you single-sign-on into your smart home dashboard via Authentik, Keycloak, Authelia, Pocket ID, Zitadel or any other OIDC provider. It's aimed at self-hosters/homelab users who already run an identity provider and want one login for their whole stack instead of a separate HA password.
Takes the spec seriously: implements OIDC core, PKCE (RFC 7636), and OAuth2 security BBest-practices (RFC 9700), with a dedicated security.yaml CI workflow and a real security-focused test suite (unit, integration, webserver, config-flow, mocked OIDC server with scenario fixtures for malformed discovery docs, wrong signing algorithms, etc.). It deliberately minimizes patching of HA core so upgrades are less likely to break login, has dedicated setup docs per provider rather than one generic guide, and offers both UI config flow and YAML for people who need options not exposed in the UI.
Auth is the single highest-blast-radius thing you can bolt onto a home automation system — a bug here can lock every household member out of lights, locks, and alarms, and HA has no official plugin API for auth providers, so this integration is reverse-engineering/hooking into internals that could shift under it despite the stated goal of minimal patching. It's a single-maintainer project distributed through HACS rather than upstreamed into HA core, so you're trusting one person's release cadence for a security-critical component. The README doesn't address what happens when your OIDC provider is unreachable (no documented local/break-glass fallback), which matters a lot for a self-hosted setup where the identity provider and Home Assistant might go down together.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →