What causes "authentication_failed" in home-assistant/core?

Generate a fresh PAT in Azure DevOps (User settings > Personal access tokens) with Read scopes for Build, Code, Project and Team Information.

home-assistant/core · error · ConfigEntryAuthFailed

authentication_failed

Error message

authentication_failed

What it means

Raised as ConfigEntryAuthFailed (translation_key authentication_failed, placeholder title) by the Azure DevOps coordinator's authorize() when client.authorize(pat, organization) completes without transport error but self.client.authorized is False — the Azure DevOps API did not accept the personal access token. Home Assistant then launches the re-auth flow. Note authorize() is wrapped by ado_exception_none_handler, so the ConfigEntryAuthFailed propagates as-is.

Source

Thrown at homeassistant/components/azure_devops/coordinator.py:90

            name=DOMAIN,
            update_interval=timedelta(seconds=300),
        )

        self.client = DevOpsClient(session=async_get_clientsession(hass))
        self.organization = config_entry.data[CONF_ORG]

    @ado_exception_none_handler
    async def authorize(
        self,
        personal_access_token: str,
    ) -> bool:
        """Authorize with Azure DevOps."""
        await self.client.authorize(
            personal_access_token,
            self.organization,
        )
        if not self.client.authorized:
            raise ConfigEntryAuthFailed(
                translation_domain=DOMAIN,
                translation_key="authentication_failed",
                translation_placeholders={"title": self.title},
            )

        return True

    @ado_exception_none_handler
    async def get_project(
        self,
        project: str,
    ) -> Project | None:
        """Get the project."""
        return await self.client.get_project(
            self.organization,
            project,
        )

View on GitHub (pinned to 58a3fdb3ea)

Solutions

Generate a fresh PAT in Azure DevOps (User settings > Personal access tokens) with Read scopes for Build, Code, Project and Team Information.
Complete the re-authentication flow triggered by this error and paste the new token.
Confirm the PAT belongs to the same organization and the account has access to the configured project.
If org policy disables PATs, use a service account or adjust policy; the API cannot authorize otherwise.

Defensive patterns

Strategy: try-catch

Validate before calling

async def pat_works(client, organization: str, pat: str) -> bool:
    await client.authorize(pat, organization)
    return client.authorized

Try / catch

from homeassistant.exceptions import ConfigEntryAuthFailed

try:
    await coordinator.authorize(pat)
except ConfigEntryAuthFailed:
    # PAT rejected: launch re-auth flow, never retry the same token
    start_reauth(entry)

Prevention

Create PATs with the longest allowed lifetime or calendar a rotation reminder.
Test a new PAT against the org's connectionData endpoint before configuring HA.
On token regeneration, immediately update it in Home Assistant via re-auth.

When it happens

Trigger: POSTing the PAT to the organization's _apis/connectionData endpoint returns 401/203-non-authorized: expired or revoked PAT, PAT from a different organization/Azure AD tenant, insufficient scope, or SSO policy blocking basic PAT auth.

Common situations: PAT expired (default 30/90 day lifetime); user regenerated the token but did not update HA; organization enforces SSH/OAuth only; PAT created in a different AzDO org.

Understand the failure class

Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

AI-assisted analysis of home-assistant/core@58a3fdb3ea (2026-08-14). Data as JSON: /api/errors/35f8240cfa7681ba. Report an issue: GitHub.