home-assistant/core · warning · InvalidAuthError

Not in trusted_networks

Error message

Not in trusted_networks

What it means

Raised by the trusted_networks auth provider when the client's IP address does not fall inside any configured trusted network. It is an InvalidAuthError, meaning Home Assistant refuses to authenticate the client automatically via trusted networks and the user must log in with credentials instead.

Source

Thrown at homeassistant/auth/providers/trusted_networks.py:201

        Trusted network auth provider should never create new user.
        """
        raise NotImplementedError

    @callback
    def async_validate_access(self, ip_addr: IPAddress) -> None:
        """Make sure the access from trusted networks.

        Raise InvalidAuthError if not.
        Raise InvalidAuthError if trusted_networks is not configured.
        """
        if not self.trusted_networks:
            raise InvalidAuthError("trusted_networks is not configured")

        if not any(
            ip_addr in trusted_network for trusted_network in self.trusted_networks
        ):
            raise InvalidAuthError("Not in trusted_networks")

        if any(ip_addr in trusted_proxy for trusted_proxy in self.trusted_proxies):
            raise InvalidAuthError("Can't allow access from a proxy server")

        if is_cloud_connection(self.hass):
            raise InvalidAuthError("Can't allow access from Home Assistant Cloud")

    @callback
    @override
    def async_validate_refresh_token(
        self, refresh_token: RefreshToken, remote_ip: str | None = None
    ) -> None:
        """Verify a refresh token is still valid."""
        if remote_ip is None:
            raise InvalidAuthError(
                "Unknown remote ip can't be used for trusted network provider."
            )
        self.async_validate_access(ip_address(remote_ip))

View on GitHub (pinned to 58a3fdb3ea)

Solutions

  1. Add the client's subnet to trusted_networks in the auth provider config (e.g. 192.168.1.0/24) and restart Home Assistant
  2. If behind a reverse proxy, configure use_x_forwarded_for and trusted_proxies in the http: integration so the real client IP is used
  3. Log in with username/password instead — the error only blocks passwordless trusted-network login

Example fix

# configuration.yaml
homeassistant:
  auth_providers:
    - type: trusted_networks
      trusted_networks:
        - 192.168.1.0/24
        - 172.16.0.0/12  # after: include VPN/docker ranges
Defensive patterns

Strategy: validation

Validate before calling

import ipaddress

client = ipaddress.ip_address("192.168.1.50")
trusted = [ipaddress.ip_network(n) for n in provider.trusted_networks]
if not any(client in net for net in trusted):
    # skip passwordless login, fall back to credential flow
    ...

Type guard

def is_in_trusted_networks(ip: str, networks: list[str]) -> bool:
    addr = ipaddress.ip_address(ip)
    return any(
        addr in ipaddress.ip_network(n)
        for n in networks
        if ipaddress.ip_network(n).version == addr.version
    )

Try / catch

try:
    provider.async_validate_access(ip_addr)
except InvalidAuthError:
    # fall back to interactive login; do not retry blindly

Prevention

When it happens

Trigger: Calling async_validate_access(ip_addr) (directly, or via async_validate_refresh_token when a trusted-networks refresh token is used) with an IP that is not contained in any ip_network listed under the provider's trusted_networks configuration.

Common situations: Client connects from a new subnet (e.g. DHCP change, new VLAN, docker/VPN ranges not listed), the provider config in configuration.yaml lists the wrong CIDR, or a reverse proxy makes the request appear to come from the proxy host's IP instead of the real client.

Related errors

AI-assisted analysis of home-assistant/core@58a3fdb3ea (2026-08-14). Data as JSON: /api/errors/1878696e46bc697f. Report an issue: GitHub.