{"record":{"id":"1878696e46bc697f","repo":"home-assistant/core","slug":"not-in-trusted-networks","errorCode":null,"errorMessage":"Not in trusted_networks","messagePattern":"Not in trusted_networks","errorType":"exception","errorClass":"InvalidAuthError","httpStatus":null,"severity":"warning","filePath":"homeassistant/auth/providers/trusted_networks.py","lineNumber":201,"sourceCode":"\n        Trusted network auth provider should never create new user.\n        \"\"\"\n        raise NotImplementedError\n\n    @callback\n    def async_validate_access(self, ip_addr: IPAddress) -> None:\n        \"\"\"Make sure the access from trusted networks.\n\n        Raise InvalidAuthError if not.\n        Raise InvalidAuthError if trusted_networks is not configured.\n        \"\"\"\n        if not self.trusted_networks:\n            raise InvalidAuthError(\"trusted_networks is not configured\")\n\n        if not any(\n            ip_addr in trusted_network for trusted_network in self.trusted_networks\n        ):\n            raise InvalidAuthError(\"Not in trusted_networks\")\n\n        if any(ip_addr in trusted_proxy for trusted_proxy in self.trusted_proxies):\n            raise InvalidAuthError(\"Can't allow access from a proxy server\")\n\n        if is_cloud_connection(self.hass):\n            raise InvalidAuthError(\"Can't allow access from Home Assistant Cloud\")\n\n    @callback\n    @override\n    def async_validate_refresh_token(\n        self, refresh_token: RefreshToken, remote_ip: str | None = None\n    ) -> None:\n        \"\"\"Verify a refresh token is still valid.\"\"\"\n        if remote_ip is None:\n            raise InvalidAuthError(\n                \"Unknown remote ip can't be used for trusted network provider.\"\n            )\n        self.async_validate_access(ip_address(remote_ip))","sourceCodeStart":183,"sourceCodeEnd":219,"githubUrl":"https://github.com/home-assistant/core/blob/58a3fdb3ea0538617f0a07efcfba6294de64fd59/homeassistant/auth/providers/trusted_networks.py#L183-L219","documentation":"Raised by the trusted_networks auth provider when the client's IP address does not fall inside any configured trusted network. It is an InvalidAuthError, meaning Home Assistant refuses to authenticate the client automatically via trusted networks and the user must log in with credentials instead.","triggerScenarios":"Calling async_validate_access(ip_addr) (directly, or via async_validate_refresh_token when a trusted-networks refresh token is used) with an IP that is not contained in any ip_network listed under the provider's trusted_networks configuration.","commonSituations":"Client connects from a new subnet (e.g. DHCP change, new VLAN, docker/VPN ranges not listed), the provider config in configuration.yaml lists the wrong CIDR, or a reverse proxy makes the request appear to come from the proxy host's IP instead of the real client.","solutions":["Add the client's subnet to trusted_networks in the auth provider config (e.g. 192.168.1.0/24) and restart Home Assistant","If behind a reverse proxy, configure use_x_forwarded_for and trusted_proxies in the http: integration so the real client IP is used","Log in with username/password instead — the error only blocks passwordless trusted-network login"],"exampleFix":"# configuration.yaml\nhomeassistant:\n  auth_providers:\n    - type: trusted_networks\n      trusted_networks:\n        - 192.168.1.0/24\n        - 172.16.0.0/12  # after: include VPN/docker ranges","handlingStrategy":"validation","validationCode":"import ipaddress\n\nclient = ipaddress.ip_address(\"192.168.1.50\")\ntrusted = [ipaddress.ip_network(n) for n in provider.trusted_networks]\nif not any(client in net for net in trusted):\n    # skip passwordless login, fall back to credential flow\n    ...","typeGuard":"def is_in_trusted_networks(ip: str, networks: list[str]) -> bool:\n    addr = ipaddress.ip_address(ip)\n    return any(\n        addr in ipaddress.ip_network(n)\n        for n in networks\n        if ipaddress.ip_network(n).version == addr.version\n    )","tryCatchPattern":"try:\n    provider.async_validate_access(ip_addr)\nexcept InvalidAuthError:\n    # fall back to interactive login; do not retry blindly","preventionTips":["Keep trusted_networks minimal and CIDR-accurate","Prefer device-specific /32 entries over broad ranges","Re-test trusted login after network/DHCP changes"],"tags":["auth","trusted-networks","ip-config","home-assistant"],"backgroundTag":null,"analyzedSha":"58a3fdb3ea0538617f0a07efcfba6294de64fd59","analyzedAt":"2026-08-14T20:54:38.818Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}