{"record":{"id":"1d3be53de5559323","repo":"home-assistant/core","slug":"can-t-allow-access-from-home-assistant-cloud","errorCode":null,"errorMessage":"Can't allow access from Home Assistant Cloud","messagePattern":"Can't allow access from Home Assistant Cloud","errorType":"exception","errorClass":"InvalidAuthError","httpStatus":null,"severity":"info","filePath":"homeassistant/auth/providers/trusted_networks.py","lineNumber":207,"sourceCode":"    def async_validate_access(self, ip_addr: IPAddress) -> None:\n        \"\"\"Make sure the access from trusted networks.\n\n        Raise InvalidAuthError if not.\n        Raise InvalidAuthError if trusted_networks is not configured.\n        \"\"\"\n        if not self.trusted_networks:\n            raise InvalidAuthError(\"trusted_networks is not configured\")\n\n        if not any(\n            ip_addr in trusted_network for trusted_network in self.trusted_networks\n        ):\n            raise InvalidAuthError(\"Not in trusted_networks\")\n\n        if any(ip_addr in trusted_proxy for trusted_proxy in self.trusted_proxies):\n            raise InvalidAuthError(\"Can't allow access from a proxy server\")\n\n        if is_cloud_connection(self.hass):\n            raise InvalidAuthError(\"Can't allow access from Home Assistant Cloud\")\n\n    @callback\n    @override\n    def async_validate_refresh_token(\n        self, refresh_token: RefreshToken, remote_ip: str | None = None\n    ) -> None:\n        \"\"\"Verify a refresh token is still valid.\"\"\"\n        if remote_ip is None:\n            raise InvalidAuthError(\n                \"Unknown remote ip can't be used for trusted network provider.\"\n            )\n        self.async_validate_access(ip_address(remote_ip))\n\n\nclass TrustedNetworksLoginFlow(LoginFlow[TrustedNetworksAuthProvider]):\n    \"\"\"Handler for the login flow.\"\"\"\n\n    def __init__(","sourceCodeStart":189,"sourceCodeEnd":225,"githubUrl":"https://github.com/home-assistant/core/blob/58a3fdb3ea0538617f0a07efcfba6294de64fd59/homeassistant/auth/providers/trusted_networks.py#L189-L225","documentation":"Raised by the trusted_networks auth provider when the request originates from a Home Assistant Cloud (Nabu Casa) remote connection. Cloud traffic traverses the internet, so IP-based trust is meaningless and is explicitly rejected.","triggerScenarios":"async_validate_access() is called while is_cloud_connection(self.hass) is true, i.e. the connection was tunneled through the SniTun/cloud remote component rather than the local network.","commonSituations":"User accesses Home Assistant via the nabucasa URL while their client IP happens to be in a trusted network; trusted-network auto-login is intentionally unavailable over Cloud.","solutions":["Access Home Assistant over the LAN (http://homeassistant.local:8123) instead of the Cloud URL when using trusted-networks login","Log in with username/password when remote via Cloud","Alternatively set up a VPN (WireGuard etc.) into the LAN so remote access presents a LAN IP"],"exampleFix":null,"handlingStrategy":"validation","validationCode":"from homeassistant.helpers.network import is_cloud_connection\n\nif is_cloud_connection(hass):\n    # skip trusted-networks login; prompt for credentials","typeGuard":null,"tryCatchPattern":"try:\n    provider.async_validate_access(ip_addr)\nexcept InvalidAuthError:\n    # show credential form; cloud clients can never use trusted login","preventionTips":["Treat Cloud URLs as untrusted for IP-based auth","Provide a VPN for remote LAN-equivalent access","Test trusted login only from the local network"],"tags":["auth","cloud","trusted-networks","home-assistant"],"backgroundTag":null,"analyzedSha":"58a3fdb3ea0538617f0a07efcfba6294de64fd59","analyzedAt":"2026-08-14T20:54:38.818Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}