home-assistant/core · warning · HomeAssistantError

Cannot delete credential in use by integration {entry.domain

Error message

Cannot delete credential in use by integration {entry.domain}

What it means

Raised as HomeAssistantError when deleting an application credential whose item_id is still referenced by a config entry's data['auth_implementation'] field. This is a safety guard: deleting the credential an entry uses for OAuth would leave the entry unable to obtain tokens, so deletion is refused until the entry is removed or reconfigured to another implementation.

Source

Thrown at homeassistant/components/application_credentials/__init__.py:121

    @override
    async def _update_data(
        self, item: dict[str, str], update_data: dict[str, str]
    ) -> dict[str, str]:
        """Return a new updated data object."""
        raise ValueError("Updates not supported")

    @override
    async def async_delete_item(self, item_id: str) -> None:
        """Delete item, verifying credential is not in use."""
        if item_id not in self.data:
            raise collection.ItemNotFound(item_id)

        # Cannot delete a credential currently in use by a ConfigEntry
        current = self.data[item_id]
        entries = self.hass.config_entries.async_entries(current[CONF_DOMAIN])
        for entry in entries:
            if entry.data.get("auth_implementation") == item_id:
                raise HomeAssistantError(
                    f"Cannot delete credential in use by integration {entry.domain}"
                )

        await super().async_delete_item(item_id)

    async def async_import_item(self, info: dict[str, str]) -> None:
        """Import an yaml credential if it does not already exist."""
        suggested_id = self._get_suggested_id(info)
        if self.id_manager.has_id(slugify(suggested_id)):
            return
        await self.async_create_item(info)

    def async_client_credentials(self, domain: str) -> dict[str, ClientCredential]:
        """Return ClientCredentials in storage for the specified domain."""
        credentials = {}
        for item in self.async_items():
            if item[CONF_DOMAIN] != domain:
                continue

View on GitHub (pinned to 58a3fdb3ea)

Solutions

Delete the config entry (or entries) that use the credential first, then retry the credential deletion.
Alternatively, reconfigure/re-add the config entry so it authenticates with a different credential or auth implementation, then delete the old credential.
Find the blocking entry by checking each entry's data['auth_implementation'] for the credential's item_id.

Example fix

for entry in hass.config_entries.async_entries(domain):
    if entry.data.get("auth_implementation") == item_id:
        await hass.config_entries.async_remove(entry.entry_id)
await app_credentials_collection.async_delete_item(item_id)

Defensive patterns

Strategy: validation

Validate before calling

def credential_in_use(hass, collection, item_id: str) -> bool:
    current = collection.data.get(item_id)
    if current is None:
        return False
    for entry in hass.config_entries.async_entries(current["domain"]):
        if entry.data.get("auth_implementation") == item_id:
            return True
    return False

Try / catch

from homeassistant.exceptions import HomeAssistantError

try:
    await collection.async_delete_item(item_id)
except HomeAssistantError as err:
    if "in use by integration" in str(err):
        # remove/reconfigure the blocking config entry, then retry
        raise

Prevention

Remove config entries before deleting the credentials they use.
Inspect entry.data['auth_implementation'] to find which entry pins a credential.
Automate credential rotation as: reconfigure entry to new credential, then delete old.

When it happens

Trigger: Calling application_credentials/delete for an item where any config entry of the same domain has entry.data['auth_implementation'] == item_id. The lookup iterates all config entries for the credential's domain.

Common situations: Rotating OAuth client credentials that are actively used by a configured integration; cleaning up old credentials after reconfiguring but forgetting to remove the config entry that still points at them; multiple config entries sharing one credential.

Related errors

AI-assisted analysis of home-assistant/core@58a3fdb3ea (2026-08-14). Data as JSON: /api/errors/9873720f8d6803c7. Report an issue: GitHub.