home-assistant/core · error · InvalidAuthError

Unknown remote ip can't be used for trusted network provider

Error message

Unknown remote ip can't be used for trusted network provider.

What it means

Raised when a refresh token created by the trusted_networks provider is validated without a remote IP. Because this provider's entire security model is 'the client IP must be in a trusted network', an unknown (None) remote IP cannot be verified and the token is rejected with InvalidAuthError.

Source

Thrown at homeassistant/auth/providers/trusted_networks.py:216

        if not any(
            ip_addr in trusted_network for trusted_network in self.trusted_networks
        ):
            raise InvalidAuthError("Not in trusted_networks")

        if any(ip_addr in trusted_proxy for trusted_proxy in self.trusted_proxies):
            raise InvalidAuthError("Can't allow access from a proxy server")

        if is_cloud_connection(self.hass):
            raise InvalidAuthError("Can't allow access from Home Assistant Cloud")

    @callback
    @override
    def async_validate_refresh_token(
        self, refresh_token: RefreshToken, remote_ip: str | None = None
    ) -> None:
        """Verify a refresh token is still valid."""
        if remote_ip is None:
            raise InvalidAuthError(
                "Unknown remote ip can't be used for trusted network provider."
            )
        self.async_validate_access(ip_address(remote_ip))


class TrustedNetworksLoginFlow(LoginFlow[TrustedNetworksAuthProvider]):
    """Handler for the login flow."""

    def __init__(
        self,
        auth_provider: TrustedNetworksAuthProvider,
        ip_addr: IPAddress,
        available_users: dict[str, str | None],
        allow_bypass_login: bool,
    ) -> None:
        """Initialize the login flow."""
        super().__init__(auth_provider)
        self._available_users = available_users

View on GitHub (pinned to 58a3fdb3ea)

Solutions

1. Pass the actual remote IP: async_validate_refresh_token(token, request.remote_ip) at every call site
2. Ensure the connection goes through a normal HTTP transport so Home Assistant can derive the peer IP
3. If writing a custom auth consumer, use hass.auth.async_validate_refresh_token with the request context, not a bare call

Example fix

# before
await provider.async_validate_refresh_token(token)
# after
await provider.async_validate_refresh_token(token, request.remote_ip)

if (remote_ip := request.remote_ip) is None:
    # reject early with a clear message before calling the provider
    raise ValueError("remote IP unavailable")
provider.async_validate_refresh_token(token, remote_ip)

def has_remote_ip(request) -> bool:
    return request is not None and request.remote_ip is not None

try:
    provider.async_validate_refresh_token(token, remote_ip)
except InvalidAuthError:
    # treat as unauthenticated; never retry with None again

When it happens

Trigger: async_validate_refresh_token(refresh_token, remote_ip) is called with remote_ip=None (e.g. a websocket/API call where the transport did not supply a peer address, or a caller omits the argument).

Common situations: Internal code paths or custom integrations that call the auth API without passing the request's remote address; unusual proxies stripping peer info; direct loopback tooling that has no socket peer.

Related errors

• User is not active
• System generated users cannot have refresh tokens connected
• System generated users can only have system type refresh tok
• Client is required to generate a refresh token.
• Client_name is required for long-lived access token

AI-assisted analysis of home-assistant/core@58a3fdb3ea (2026-08-14). Data as JSON: /api/errors/10a0e2b19d30cefe. Report an issue: GitHub.