home-assistant/core · critical · ConfigEntryAuthFailed
auth_expired
Error message
auth_expired
What it means
Raised as ConfigEntryAuthFailed (translation auth_expired) from the coordinator when api.update() raises ExpiredAccessTokenError or InvalidGrantError during a refresh: the refresh token that worked at setup has since been revoked or expired. HA transitions the entry into reauth-needed, halts coordinator retries, and prompts the user to log in again.
Source
Thrown at homeassistant/components/anglian_water/coordinator.py:83
self.api = api
@override
async def _async_update_data(self) -> None:
"""Update data from Anglian Water's API."""
try:
await self.api.update(self.config_entry.data[CONF_ACCOUNT_NUMBER])
await self._insert_statistics()
except ConsentRequiredError as err:
async_create_consent_required_issue(
self.hass, self.config_entry.data[CONF_ACCOUNT_NUMBER]
)
raise UpdateFailed(
translation_domain=DOMAIN,
translation_key="consent_required",
retry_after=900.0,
) from err
except (ExpiredAccessTokenError, InvalidGrantError) as err:
raise ConfigEntryAuthFailed(
translation_domain=DOMAIN,
translation_key="auth_expired",
) from err
except UnknownEndpointError as err:
raise UpdateFailed(
translation_domain=DOMAIN,
translation_key="service_unavailable",
retry_after=60.0,
) from err
else:
async_delete_consent_required_issue(
self.hass, self.config_entry.data[CONF_ACCOUNT_NUMBER]
)
async def _insert_statistics(self) -> None:
"""Insert statistics for water meters into Home Assistant."""
for meter in self.api.meters.values():
id_prefix = (View on GitHub (pinned to 58a3fdb3ea)
Solutions
- Complete the re-auth flow on the integration entry.
- Ensure only one HA instance uses these Anglian Water credentials.
- If restoring from backup, re-authenticate after restore — the old refresh token was already used.
Defensive patterns
Strategy: try-catch
Try / catch
ConfigEntryAuthFailed stops coordinator retries and opens reauth — drive the reauth flow; do not catch and retry in custom wrappers.
Prevention
- Never share the account across instances or restored backups.
- Expect reauth after provider-side password/token resets.
When it happens
Trigger: api.update() mid-session receiving invalid_grant from the Anglian Water IdP — token revoked server-side, password reset, or a concurrent client consumed the rotating refresh token.
Common situations: Password changes after the entry was configured; two HA instances or a re-imported backup using the same token; provider-side session invalidation.
Related errors
AI-assisted analysis of home-assistant/core@58a3fdb3ea (2026-08-14).
Data as JSON: /api/errors/21d79211ca312de6.
Report an issue: GitHub.