home-assistant/core · error · InvalidAuthError

trusted_networks is not configured

Error message

trusted_networks is not configured

What it means

InvalidAuthError raised by TrustedNetworksAuthProvider.async_validate_access (homeassistant/auth/providers/trusted_networks.py:196) when the provider config has an empty/missing trusted_networks list. Without any trusted networks configured, every access attempt is rejected; this fires before the IP membership, proxy, and cloud checks that follow.

Source

Thrown at homeassistant/auth/providers/trusted_networks.py:196

    @override
    async def async_user_meta_for_credentials(
        self, credentials: Credentials
    ) -> UserMeta:
        """Return extra user metadata for credentials.

        Trusted network auth provider should never create new user.
        """
        raise NotImplementedError

    @callback
    def async_validate_access(self, ip_addr: IPAddress) -> None:
        """Make sure the access from trusted networks.

        Raise InvalidAuthError if not.
        Raise InvalidAuthError if trusted_networks is not configured.
        """
        if not self.trusted_networks:
            raise InvalidAuthError("trusted_networks is not configured")

        if not any(
            ip_addr in trusted_network for trusted_network in self.trusted_networks
        ):
            raise InvalidAuthError("Not in trusted_networks")

        if any(ip_addr in trusted_proxy for trusted_proxy in self.trusted_proxies):
            raise InvalidAuthError("Can't allow access from a proxy server")

        if is_cloud_connection(self.hass):
            raise InvalidAuthError("Can't allow access from Home Assistant Cloud")

    @callback
    @override
    def async_validate_refresh_token(
        self, refresh_token: RefreshToken, remote_ip: str | None = None
    ) -> None:
        """Verify a refresh token is still valid."""

View on GitHub (pinned to 58a3fdb3ea)

Solutions

1. Add the trusted networks under the provider, e.g. `- type: trusted_networks\n trusted_networks:\n - 192.168.1.0/24`, then restart
2. Validate the config with `hass --script check_config` to catch key/indentation errors
3. Ensure the requesting client's IP actually falls inside one of the listed networks to avoid the follow-up 'Not in trusted_networks' error

Example fix

# before (configuration.yaml)
homeassistant:
  auth_providers:
    - type: trusted_networks  # no trusted_networks key

# after
homeassistant:
  auth_providers:
    - type: trusted_networks
      trusted_networks:
        - 192.168.1.0/24

if not provider.trusted_networks:
    raise ValueError("configure trusted_networks before using this provider")
provider.async_validate_access(ip_addr)

from homeassistant.auth import InvalidAuthError
try:
    provider.async_validate_access(ip_addr)
except InvalidAuthError as err:
    if "not configured" in str(err):
        # config problem, not a client problem
        raise ConfigError("trusted_networks missing in configuration.yaml") from err
    raise

When it happens

Trigger: Authenticating via the trusted_networks flow while configuration.yaml defines the provider without a trusted_networks key (or an empty list); a typo like trusted_network instead of trusted_networks silently yields no entries.

Common situations: Copy-pasted trusted-networks config with wrong key names; config edited to remove networks but provider left enabled; YAML indentation mistakes putting the list in the wrong block.

Related errors

• Unable to load mfa module {module_name}: {err}
• Unable to load auth provider {provider}: {err}
• User is not active
• System generated users cannot have refresh tokens connected
• System generated users can only have system type refresh tok

AI-assisted analysis of home-assistant/core@58a3fdb3ea (2026-08-14). Data as JSON: /api/errors/c8e0fbb293f1e36f. Report an issue: GitHub.