Home Assistant: Adding PKCE support

Aug 11, 2026

Home Assistant is an open source, local focussed home automation platform, why would it need PKCE support? Not all devices have a local api, and for those products and services that only have a cloud api or are in fact cloud only we want the most secure way to connect.

Why does Home Assistant need PKCE support?

The reason for me to get involved was that I wanted the data from my new car integrated in Home Assistant. After seeing all the cool integrations with other cars, I thought I want that as well for my new “connected” car. The “new” volvo connected api required using PKCE to get a token. And since my car was brand new it was never connected to the old API.

What is PKCE?

The OAuth2 code flow, requires a secret to validate the application when exchanging a code for a token. This flow is great for server applications, but not the best for client applications. Client applications run one the client (mobile apps, single page apps, javascript things) and CANNOT keep a secret. To be able to use the code flow the designed the Proof Key for Code Exchange (PKCE for short) extension.

The client generates a random string, this string is then hashed using SHA256 and send with the initial request. When exchanging the code for the token the original string is sent to the server as well proving this client made the original Authorization request.

OAuth2 code flow

The client in this case should keep the secret, well secret, which is impossible on “public” clients. This flow is only suited for server applications.

sequenceDiagram participant User participant Client participant AuthServer as Identity Provider User->>Client: Initiate login Client->>AuthServer: Authorization request (client_id, redirect_uri, scope, state) AuthServer->>User: Login & consent page User->>AuthServer: Authenticate & approve AuthServer->>Client: Redirect with authorization code Client->>AuthServer: Token request (code, client_id, client_secret, redirect_uri) AuthServer->>Client: Access token + refresh token

OAuth2 code flow with PKCE

Look mom, no secret 🔑 needed.

sequenceDiagram participant User participant Client participant AuthServer as Identity Provider Client->>Client: Generate code_verifier + code_challenge (SHA-256) User->>Client: Initiate login Client->>AuthServer: Authorization request (client_id, redirect_uri, scope, state, code_challenge, code_challenge_method=S256) AuthServer->>User: Login & consent page User->>AuthServer: Authenticate & approve AuthServer->>Client: Redirect with authorization code Client->>AuthServer: Token request (code, client_id, redirect_uri, code_verifier) AuthServer->>AuthServer: Verify SHA-256(code_verifier) == code_challenge AuthServer->>Client: Access token + refresh token

Bringing PKCE support to Home Assistant

It all started with me wanting to integrate the new Volvo Connected API into Home Assistant, so it started with a feature request. After waiting for about a month I decided that building something like this would not be very complicated, so I started tinkering with it. And I then created a PR with the code and a separate pr with the updated docs.

After an extensive review this pr was approved and merged a month later. Meaning it would be released in the next release. Then the moment was there and Home Assistant 2025.4 was released, with my PR in it.

January 2025 PKCE feature request
February 2025 PKCE PR for Home Assistant
Febuary 2025 Home Assistant docs PR
March 2025 PR approval 🎉

Now what?

Home Assistant has support for the code flow with PKCE for over a year now. The Volvo integration definitely uses it. As this is where it all started.

I’m not sure about other integrations that use it, but in my opinion it is not used enough. So I created Microsoft Calendar a custom integration that uses the PKCE flow to connect to Microsoft Graph and shows your calendars in Home Assistant.

What else has to be connected to home assistant in your opinion? Let me know on the socials.

Home Assistant 2025.4 release notes