Access tokens
Let an AI client or another app on your network talk to the home, within limits you set.
What a token is
A token is a key for one app. Each has a name, a purpose, a list of permissions and an optional expiry, and you can revoke it alone without touching the others. Tokens work on your local network only, and every call made with one is written to Activity.
Create one
Settings › Access › + New token.
- What is it for — An AI assistant (MCP) for Claude, ChatGPT, Cursor or any MCP client; An integration or app for Home Assistant, Node‑RED, a script or an installer's tool calling the local API. Give it a name that says who will use it.
- What may it do — tick the permissions:
| Permission | Allows |
|---|---|
| Read devices | Rooms, devices and their current state |
| Control devices | Switch, dim, move blinds, set temperatures, lock and unlock |
| Run scenes | Trigger scenes like Good night or Away |
| Read workflows | List automations and see whether they are on |
| Change workflows | Create, edit, enable or disable automations |
| Read trends | Energy, history series, costs and the weather |
| Live events | Follow state changes as they happen |
- Create token. The secret is shown once: copy it now. For an MCP token you also get the ready‑to‑paste client configuration.
What a token can never do
Whatever permissions you tick, a token gives no access to the gateway's system, files, network settings, updates or user accounts. Those stay in the web app, behind your password.
Manage
- Revoke stops a token immediately; it stays in the list, marked Revoked, so its history remains readable. Remove deletes it.
- Activity shows every call: which token, what it asked for, from which address, and whether it was allowed.
- Set an expiry for tokens you hand to third parties.
If a secret leaks
Revoke it and create a new one. Nothing else needs to change.