Homeassistant authorization callback error with 0.211.1

[xMatzeDE]

Describe the bug

Authorize homeassistant, always end up in "callback error"

Steps to reproduce

1. Open Authorize to Homeassistant from "Burger menu" or from settings
2. Login to Home Assistant with Admin credentials
3. After 3-4 seconds it end up with callback error

Configuration details

root@evcc:~# evcc dump --cfg
[main  ] INFO 2025/12/10 21:25:33 using config file: /etc/evcc.yaml
[main  ] INFO 2025/12/10 21:25:33 using sqlite database: /var/lib/evcc/evcc.db
[mercedes] DEBUG 2025/12/10 21:25:38 identity.NewIdentity - database token found
[lp-1  ] DEBUG 2025/12/10 21:25:38 charge total import: 20137.875kWh

Version: `0.211.1`



# open evcc at http://evcc.local:7070
network:
  schema: http
  host: evcc.home.arpa # .local suffix announces the hostname on MDNS
  port: 7070

database:
  type: sqlite
  dsn: /var/lib/evcc/evcc.db

log: debug
levels:
  cache: error


- type: template
#  template: offline
  template: homeassistant
  uri: http://homeass.home.arpa:8123
  soc: sensor.*************_batterie
  name: e208
  title: Peugeot e208
  capacity: 50
  icon: car
  phases: 3
  mode: pv
  minCurrent: 6
  maxCurrent: 16
  identifiers:
  - *****
  welcomecharge:

Log details

nslookup evcc.home.arpa
Server: adguard.home.arpa
Address: 192.168.100.11

Name: evcc.home.arpa
Address: 192.168.100.254

nslookup homeass.home.arpa
Server: adguard.home.arpa
Address: 192.168.100.11

Name: homeass.home.arpa
Address: 192.168.100.10

[homeassistant] TRACE 2025/12/10 21:30:30 POST http://homeass.home.arpa:8123/auth/token
[homeassistant] TRACE 2025/12/10 21:30:35 client_id=http%3A%2F%2F192.168.100.254%3A7070&code=7736fa0007ed4b15ab982999122f7b07&code_verifier=ToAsdyQNqGzkfoSlz7i2ZJfGZmlZ6y_pKJ75oAFCzb0&grant_type=authorization_code&redirect_uri=http%3A%2F%2F192.168.100.254%3A7070%2Fproviderauth%2Fcallback

What type of operating system or environment does evcc run on?

Linux

External automation

• I have made sure that no external automation like HomeAssistant or Node-RED is active or accessing any of the mentioned devices when this issue occurs.

Nightly build

• I have verified that the issue is reproducible with the latest nightly build

Version

root@evcc:~# evcc -v evcc version 0.211.1

[andig]

After 3-4 seconds it end up with callback error

Where? What happens if you execute the call from the logfile using curl?

[CDank]

I just had the same issue.
Home Assistant had blocked the IP of EVCC (actually its own IP, since EVCC is running as an add-on) and added it to the ban list due to failed login attempts.

Check your ip_bans.yaml in Home Assistant to see if the EVCC IP appears there.
I got a notification in HA about failed login attempts from its own IP two days before and couldn’t figure out why - until I discovered that EVCC had stopped running and the HTTP GET requests from Home Assistant weren’t working anymore either.

If you remove the IP from the ban list and restart HA / EVCC, it should work again.

So far, I’ve also noticed that the authorization between EVCC and HA has to be redone every time either HA or EVCC restarts.
Is that normal behavior?
Would it be possible to set up authorization using a long-term token instead?

[CDank]

Unfortunately, I have no idea - the failed login attempts happened 2–3 days ago, and I’m not sure anymore whether I might have updated EVCC or made some other change around that time.

Could it be that when the authorization expires, EVCC keeps trying to log into HA?
After several failed login attempts, HA automatically blocks the IP from which the requests come.

I had already noticed that under certain conditions (like after restarting EVCC or HA), the authorization had to be redone.
That’s why I was wondering whether this could maybe be solved using a long-term token instead.

[CDank]

I just checked again: for me, the issue was already present in 0.211.0, not only in 0.211.1.
It might have been introduced during the update to 0.211.0, but I can’t verify that anymore.

[xMatzeDE]

I've checked the Home Assisstant /config directoy, but there is no ip_bans.yaml
so thats not be the issue in my case

[jmaass]

I have the same issue and also have no ip_bans.yaml in my config directory. I would really appreciate it if the code could be changed so that a long term access token authentication is possible, this is the easiest way to connect both instances and avoids the authentication issue after each evcc restart.

[andig]

I would appreciate if we could find the root cause of the auth issue.

[jmaass]

My EVCC instance is at http://<my_nas_fqdn>/evcc, which is portal to http://<my_nas_fqdn>:7070. During EVCC startup, I see the following error in the logs: Request failed with status code 404. GET http://<my_nas_fqdn>/evcc/api/config/devices/vehicle Could that have something to do with the problem? The error appeared after configuring the home assistant template. Maybe a wrong API call or a call with the wrong credentials?

[CDank]

At the moment, I unfortunately can’t add anything regarding the root cause, since no further issues have occurred since then.
I restarted both Home Assistant and EVCC a few times for testing and did not run into any problems requiring re-authentication.

I have no idea what went wrong that caused the login attempts to fail and ultimately led to the IP being blocked.

In my configuration, I’m using both the Home Assistant device integration as well as MQTT via the HA broker, and HTTP GET commands (with a long-term token) to read and set entities.

The only thing I haven’t tried yet to possibly reproduce the issue is restarting the host OS.

[cschlipf]

Could this be related to this issue? #25788

Since 0.211 specifying the Home Assistant server by hostname does no longer work. You need to specify it by its IP address.

[andig]

Logfile?

[jmaass]

Ich habe das gerade an meinen Instanzen ausprobiert, einmal mit long lived token und einmal ohne. Beides Mal hängt die Authentisierung nach dem erfolgreichen Einloggen in Homeassistant. Hier sind die Logfiles von Homeassistent: 2025-12-28 08:16:29.633 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.178.140 (192.168.178.140). Requested URL: '/auth/login_flow/f64a45c7b6fe3bb13c9ee966f5214167'. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15) 2025-12-28 08:17:35.154 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.178.140 (192.168.178.140). Requested URL: '/auth/login_flow/43ffe3f7abb6f294ecbada3bbb6ae833'. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15) 2025-12-28 08:21:00.684 ERROR (MainThread) [custom_components.evcc_intg.pyevcc_ha] ***@***.***: WSServerHandshakeError - 502, message='Invalid response status', url='ws://nas.maassgang.de/evcc/ws' 2025-12-28 08:23:20.432 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.178.140 (192.168.178.140). Requested URL: '/auth/login_flow/5ddf4f87a5553c81b3eae56b6a716995'. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15) 2025-12-28 08:24:47.494 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from fe80::bc:7d78:a9e7:ae6c (fe80::bc:7d78:a9e7:ae6c). Requested URL: '/auth/login_flow/77b991ae4cbafc9ce29503287be7f2be'. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15) 2025-12-28 08:29:57.059 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.178.140 (192.168.178.140). Requested URL: '/auth/login_flow/50ced306bc8781fcd8b2b560bb73b6b5'. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15)

…

Am 27.12.2025 um 23:38 schrieb andig ***@***.***>: Logfile? — Reply to this email directly, view it on GitHub <#25961 (reply in thread)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ACQDEBHCGIFO6DZ6ZXJUIPL4D4C5BAVCNFSM6AAAAACOYZ73PWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTKMZVGM4TINA>. You are receiving this because you commented.

[CDank]

Ich habe das gerade an meinen Instanzen ausprobiert, einmal mit long lived token und einmal ohne. Beides Mal hängt die Authentisierung nach dem erfolgreichen Einloggen in Homeassistant. Hier sind die Logfiles von Homeassistent: 2025-12-28 08:16:29.633 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.178.140 (192.168.178.140). Requested URL: '/auth/login_flow/f64a45c7b6fe3bb13c9ee966f5214167'. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15) 2025-12-28 08:17:35.154 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.178.140 (192.168.178.140). Requested URL: '/auth/login_flow/43ffe3f7abb6f294ecbada3bbb6ae833'. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15) 2025-12-28 08:21:00.684 ERROR (MainThread) [custom_components.evcc_intg.pyevcc_ha] @.: WSServerHandshakeError - 502, message='Invalid response status', url='ws://nas.maassgang.de/evcc/ws' 2025-12-28 08:23:20.432 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.178.140 (192.168.178.140). Requested URL: '/auth/login_flow/5ddf4f87a5553c81b3eae56b6a716995'. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15) 2025-12-28 08:24:47.494 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from fe80::bc:7d78:a9e7:ae6c (fe80::bc:7d78:a9e7:ae6c). Requested URL: '/auth/login_flow/77b991ae4cbafc9ce29503287be7f2be'. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15) 2025-12-28 08:29:57.059 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.178.140 (192.168.178.140). Requested URL: '/auth/login_flow/50ced306bc8781fcd8b2b560bb73b6b5'. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/26.0 Safari/605.1.15)
…
Am 27.12.2025 um 23:38 schrieb andig @.>: Logfile? — Reply to this email directly, view it on GitHub <#25961 (reply in thread)>, or unsubscribe https://github.com/notifications/unsubscribe-auth/ACQDEBHCGIFO6DZ6ZXJUIPL4D4C5BAVCNFSM6AAAAACOYZ73PWVHI2DSMVQWIX3LMV43URDJONRXK43TNFXW4Q3PNVWWK3TUHMYTKMZVGM4TINA. You are receiving this because you commented.

ich würde dir empfehlen, den link zu Deinem EVCC zu entfernen bzw. grundsätzlich abzusichern, da dein NAS sowie dein EVCC aus dem Internet erreichbar sind.

[andig]

WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.178.140 (192.168.178.140). Requested URL: '/auth/login_flow/43ffe3f7abb6f294ecbada3bbb6ae833'.

Da fragt man sich ja was da invalid sein soll. Leider sieht man die URLs nicht. Da der ganze Ablauf ausschliesslich im Browser passiert wäre es hilfreich die URLs zu sehen: evcc->HA, login, HA->evcc und dann evcc-HA für's Token.