home-assistant/core · info · InvalidAuthError

Can't allow access from Home Assistant Cloud

Error message

Can't allow access from Home Assistant Cloud

What it means

Raised by the trusted_networks auth provider when the request originates from a Home Assistant Cloud (Nabu Casa) remote connection. Cloud traffic traverses the internet, so IP-based trust is meaningless and is explicitly rejected.

Source

Thrown at homeassistant/auth/providers/trusted_networks.py:207

    def async_validate_access(self, ip_addr: IPAddress) -> None:
        """Make sure the access from trusted networks.

        Raise InvalidAuthError if not.
        Raise InvalidAuthError if trusted_networks is not configured.
        """
        if not self.trusted_networks:
            raise InvalidAuthError("trusted_networks is not configured")

        if not any(
            ip_addr in trusted_network for trusted_network in self.trusted_networks
        ):
            raise InvalidAuthError("Not in trusted_networks")

        if any(ip_addr in trusted_proxy for trusted_proxy in self.trusted_proxies):
            raise InvalidAuthError("Can't allow access from a proxy server")

        if is_cloud_connection(self.hass):
            raise InvalidAuthError("Can't allow access from Home Assistant Cloud")

    @callback
    @override
    def async_validate_refresh_token(
        self, refresh_token: RefreshToken, remote_ip: str | None = None
    ) -> None:
        """Verify a refresh token is still valid."""
        if remote_ip is None:
            raise InvalidAuthError(
                "Unknown remote ip can't be used for trusted network provider."
            )
        self.async_validate_access(ip_address(remote_ip))


class TrustedNetworksLoginFlow(LoginFlow[TrustedNetworksAuthProvider]):
    """Handler for the login flow."""

    def __init__(

View on GitHub (pinned to 58a3fdb3ea)

Solutions

1. Access Home Assistant over the LAN (http://homeassistant.local:8123) instead of the Cloud URL when using trusted-networks login
2. Log in with username/password when remote via Cloud
3. Alternatively set up a VPN (WireGuard etc.) into the LAN so remote access presents a LAN IP

from homeassistant.helpers.network import is_cloud_connection

if is_cloud_connection(hass):
    # skip trusted-networks login; prompt for credentials

try:
    provider.async_validate_access(ip_addr)
except InvalidAuthError:
    # show credential form; cloud clients can never use trusted login

When it happens

Trigger: async_validate_access() is called while is_cloud_connection(self.hass) is true, i.e. the connection was tunneled through the SniTun/cloud remote component rather than the local network.

Common situations: User accesses Home Assistant via the nabucasa URL while their client IP happens to be in a trusted network; trusted-network auto-login is intentionally unavailable over Cloud.

Related errors

• trusted_networks is not configured
• Not in trusted_networks
• Can't allow access from a proxy server
• User is not active
• System generated users cannot have refresh tokens connected

AI-assisted analysis of home-assistant/core@58a3fdb3ea (2026-08-14). Data as JSON: /api/errors/1d3be53de5559323. Report an issue: GitHub.