Skip to content

fix: add Govee 2FA login support - #652

Open
florianhorner wants to merge 1 commit into
wez:mainfrom
florianhorner:florianhorner/fix-2fa-login
Open

fix: add Govee 2FA login support#652
florianhorner wants to merge 1 commit into
wez:mainfrom
florianhorner:florianhorner/fix-2fa-login

Conversation

@florianhorner

@florianhorner florianhorner commented Apr 5, 2026 •
edited
Loading

Copy link
Copy Markdown

Summary

Fixes #647 by restoring undocumented Govee login when account 2FA is required.

  • Upgrade the undocumented login endpoint from /v1/login to /v2/login
  • Update the app version and User-Agent to match the confirmed working Govee app headers
  • Add GOVEE_2FA_CODE / --govee-2fa-code and the Home Assistant add-on govee_2fa_code option
  • Request a Govee verification code on 454 when no code is configured, with a 15-minute cache cooldown to avoid repeated email requests during restart loops
  • Treat rejected or expired verification codes as actionable login errors
  • Reduce the account-login negative cache TTL from 15 minutes to 10 seconds so users can retry within the code validity window

The API behavior is modeled after the confirmed fix in homebridge-govee.

Scope

  • One commit, rebased onto current upstream/main
  • Changed files are limited to src/undoc_api.rs, add-on config plumbing, add-on translation text, and docs/CONFIG.md
  • Adds one optional Home Assistant add-on config field: govee_2fa_code
  • No MQTT discovery topic changes
  • No Home Assistant MQTT entity schema or availability-topic changes
  • No fork branding, CI, image, changelog, or unrelated history changes

Test plan

  • cargo fmt --all -- --check
  • cargo test --all passes (35 tests)
  • cargo clippy --all -- -D warnings

@nungster nungster mentioned this pull request Apr 10, 2026
Open
@forresthopkinsa

forresthopkinsa commented Apr 11, 2026

Copy link
Copy Markdown

this is a really enormous changeset that covers a lot more than 2fa support

@florianhorner
florianhorner force-pushed the florianhorner/fix-2fa-login branch from caa2326 to a26b83f Compare April 27, 2026 21:54
@florianhorner florianhorner changed the title fix: upgrade undoc API login for 2FA support (fixes #647) fix: add Govee 2FA login support Apr 27, 2026
@florianhorner
florianhorner marked this pull request as ready for review April 27, 2026 21:58
@florianhorner

florianhorner commented Apr 27, 2026

Copy link
Copy Markdown
Author

Thanks, you're right. I rewrote this from current main and force-pushed the PR branch so it no longer carries the fork history or unrelated changes.

Current scope is one commit, 5 files, all directly tied to 2FA login support:

  • src/undoc_api.rs
  • Home Assistant add-on config/export/translation for govee_2fa_code
  • docs/CONFIG.md

No MQTT discovery topics, HA MQTT entity schema, availability topics, fork branding, CI, image config, changelog, or unrelated history remain in the PR. Local cargo fmt --all -- --check, cargo test --all, and cargo clippy --all -- -D warnings pass; GitHub build checks are still pending.

sitapix added a commit to sitapix/govee2mqtt that referenced this pull request May 3, 2026
@sitapix
feat: 2FA + APP_VERSION recovery, fan support, air-quality sensors, q…
4b224c2 
…uirks

API resilience
- undoc_api: env/CLI-overridable Govee Home app version (--govee-app-version /
  GOVEE_APP_VERSION) with helpful error when Govee raises the minimum.
  Recovers without a new release when login returns "app version is too low".
  Covers issues wez#622, wez#626, wez#627, wez#628, wez#637, wez#647, wez#649.
- undoc_api: Govee 2FA login support (status 454/455). Auto-requests an email
  code on first failure; user supplies it via --govee-2fa-code / GOVEE_2FA_CODE
  and restarts. Closes wez#656/wez#652.
- iot: refresh transaction IDs on every publish (Govee dedupes on transaction;
  reusing one silently drops the publish). Likely fixes wez#635 Tap-to-Run drops.
- hass: client id uses '-' instead of '/' so Mosquitto 7 doesn't reject it as
  a "dangerous client id". Closes wez#659/wez#661.

New entities
- fan.rs: HA MQTT Fan entity backed by the existing workMode/percent machinery.
  Power, speed-percentage (FanSpeed mode), and preset modes all wired up.
- sensor.rs: DeviceSettingDiagnostic exposes battery % and Wi-Fi level from
  the undoc DeviceSettings struct. Wi-Fi has no device_class (Govee reports
  0-100% but HA's signal_strength expects dBm). Covers wez#646/wez#668.
- sensor.rs: carbonDioxideConcentration, pm25, pm10 mappings with correct
  units, device classes, state classes, and friendly names. Promoted air-
  quality measurements to primary entities (not diagnostic).
- enumerator.rs: route fan-type devices through Fan entity; auto-add battery
  and Wi-Fi diagnostics where reported.

Effect filtering
- light.rs / device_config: per-device `allowed_effects` overrides the global
  GOVEE_ALLOWED_EFFECTS env var. Useful to keep Google Home SYNC payloads
  under the size limit without losing scene control inside HA. Closes wez#613.
- light.rs: skip empty `supported_color_modes` in MQTT light discovery so
  brightness-only bulbs (H6093) don't fail HA validation. Closes wez#589.

Quirks (device coverage)
- AirQualityMonitor device type + helpers; H5140 (CO2 monitor) and H5106
  (BLE-only AQM) classified correctly instead of falling to "Other". Closes
  wez#634, wez#561.
- LAN-capable: H616D outdoor strip, H6039 wall sconce, H61E5 strip pro.
- Color-temp clamps: H6076 (2700-6500K) and H61E5 (2700-6500K) — API
  reports 2000-9000K which is wrong. Closes wez#591, partial wez#567.
- IoT routing: H6006 bulbs now use IoT instead of rate-limited Platform API
  (10-15s delays before this). Closes wez#621.
- BLE-only classified (controllable when BLE path lands): H6125_321A,
  H6125_5321, H5129 motion sensor, H5181-H5185/H5198 meat thermometers.
  Closes wez#569, wez#580, wez#630.

Addon
- addon/config.yaml + run.sh: surface govee_app_version and govee_2fa_code
  options; redact 2FA code from env dump.
- addon/translations/en.yaml: matching strings.
@florianhorner

florianhorner commented May 8, 2026

Copy link
Copy Markdown
Author

Friendly bump — last activity was the rewrite/cleanup on Apr 27. CI is green, branch is mergeable, scope is now contained to the 2FA login path (5 files, single commit).

Govee's API change is breaking new installs and any user whose token has expired (see #647, #626, #627, #637, #649). Happy to rebase, split further, or address review feedback whenever you have time. No rush — just flagging that this one has user impact.

@miller79

miller79 commented May 23, 2026

Copy link
Copy Markdown

I've tested this branch with my home setup and it seems to accomplish everything that is required for 2fa to work. Does anyone know what the next step is to getting this merged up? This is a necessary thing for me as I use a lot of one click actions.

@LookingSharp

LookingSharp commented May 24, 2026

Copy link
Copy Markdown

@miller79 if you think this is better than #656 then sure let's go with this one. Just to add a bit more color - I've had govee gear for a while, but never tried connecting it to HomeAssistant until today. I'm not sure if existing users are able to just carry on, but as a new user I'm completely blocked unless I fork, which I might do, but I'd rather just stay on main if this can get merged soon...

@miller79

miller79 commented May 24, 2026

Copy link
Copy Markdown

@LookingSharp for sure this version is the best version of it. I have forked it myself and have tested it if you want to change repos to mine to test it yourself (https://github.com/miller79/govee2mqtt). I'm also supposing @florianhorner has it working with his version as well but yes it would be must more convenient if it's just merged here. But if we are to pick a PR that fixes the 2FA, this is the one to pick.

@Gatorzgaming

Gatorzgaming commented Jun 13, 2026

Copy link
Copy Markdown

Using @miller79 build has worked for me. LGTM and TYSM

@ndrwrbgs

ndrwrbgs commented Jun 14, 2026 via email

Copy link
Copy Markdown

@Gatorzgaming

Gatorzgaming commented Jun 14, 2026

Copy link
Copy Markdown

@ndrwrbgs check your logs

@ndrwrbgs

ndrwrbgs commented Jun 14, 2026 via email

Copy link
Copy Markdown

@miller79

miller79 commented Jun 14, 2026

Copy link
Copy Markdown

Do you have any more details on what exactly didn't work for you? Without any details of any kind it's impossible to address anything specific.

@florianhorner

florianhorner commented Jun 14, 2026

Copy link
Copy Markdown
Author

@ndrwrbgs thanks for testing. A few other setups are confirmed working above, so I'd like to understand your build or environment to rule out the fix missing a case.

Can you share:

  • which build you ran (this PR branch fix: add Govee 2FA login support #652, wez main, or another fork)
  • the exact failing log line. Still a 454 at login, or a different error after you enter the code?
  • whether you set GOVEE_2FA_CODE / govee_2fa_code with the code Govee emails you
  • HA version, and add-on vs standalone Docker

With that I can tell whether this PR misses a case or it's a separate issue.

@vkzawa

vkzawa commented Jun 17, 2026

Copy link
Copy Markdown

Using @miller79 build has worked for me. LGTM and TYSM

Thanks @miller79 for linking to your fork, made it super easy to test! ❤️

I switched to it also. I uninstalled the official one (temporarily), plugged in miller79's fork repo url, installed the 2026.05.23-62516373 version (because I still had the official repo url in there), started it up and got my 2FA token via email shortly after, plugged it into the new "Govee 2FA Code" field and it started working immediately thanks to the built-in auto-retry.

That's another successful test case here!

@vkzawa vkzawa mentioned this pull request Jun 17, 2026
Open
@ntroutman

ntroutman commented Jun 19, 2026

Copy link
Copy Markdown

Worked for me as well, though, restarting it with docker-compose was annoying to figure out the right sequence of commands.

@jknysz

jknysz commented Jun 22, 2026

Copy link
Copy Markdown

Also worked for me -- thank you!

Stumbling block caveat I'll note from my experience: Govee has more than 1 type of logon MFA/2FA.

  • A 6 digit number that comes from 'Govee' support@govee.com w/ subject '###### is your code' (the # are the actual MFA code number)
    vs
  • A 4 digit number that comes from 'Govee Support Team' no-reply@govee.com w/ subject 'E-mail verification'

I made the mistake of manually triggering MFA during login through the browser and attempting to use that code in the MFA field -- too clever for my own good!

Correct approach is to have the MFA field be empty, start the add-on, let it attempt to login and fail on the MFA step, which triggers the correct MFA email.

===
More details from my investigative journey:
When you log into the Govee app or a browser to trigger a 2FA email, that specific code is bound tightly to that exact login session attempt.

When govee2mqtt starts up, it initiates a brand new authentication session. It says to Govee: "Hey, I want to log in, and here is a code I found." Govee looks at it and says: "Wait, you never asked me for a login code from this session, so this code is invalid here."

Because the code wasn't requested by the add-on itself during its own login flow, Govee rejects it instantly.
image

@xadox-1st

xadox-1st commented Jul 13, 2026

Copy link
Copy Markdown

The fork by @miller79 works for me as well.

@ianfriend

ianfriend commented Jul 17, 2026 •
edited
Loading

Copy link
Copy Markdown

thanks @miller79 for the fork. Works for me. Are we suggesting this repo is retired and @miller79's fork becomes the new maintained version?

caledhwa added a commit to caledhwa/govee2mqtt that referenced this pull request Jul 20, 2026
@caledhwa @claude
chore: repoint image/repo references to caledhwa fork
9434c20 
Upstream main has been frozen for months while Govee's 2FA/454 login
change (fixed by the cherry-picked PR wez#652) sits unmerged. This repoints
the GHCR image references and repository metadata (addon config, addon
Dockerfile, CI image env var, docker-compose, root Dockerfile label,
repository.yaml) from wez/govee2mqtt to this fork so the add-on actually
builds and serves the patched binary instead of upstream's.

Bumps the add-on version so Supervisor treats it as a new release.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
@florianhorner

florianhorner commented Jul 20, 2026 •
edited
Loading

Copy link
Copy Markdown
Author

thanks @miller79 for the fork. Works for me. Are we suggesting this repo is retired and @miller79's fork becomes the new maintained version?

To be fair to Wez given all work that went into Govee2MQTT, and to keep this PR here reviewable for him (and mergeable): There is this proposal here as for how to keep this project alive. And I recommend to discuss the question about repo there https://github.com/wez/govee2mqt/issues/700, else these questions remain scattered across dozens of issues, PRs and whatnot. And the suggested fix here gets diluted as well because it is about Govee 2FA login support

@miller79

miller79 commented Jul 20, 2026

Copy link
Copy Markdown

Good to hear it's working for you all but yes I wouldn't want to run a fork for sure. The issue I raised #700 hopefully will get some traction on allowing a small group to own it long term that can be governed. I've sent @wez a message on Mastodon so hopefully that may get his attention as I'm sure this is not a high priority for him at the moment.

@peas peas mentioned this pull request Jul 31, 2026
Closed
semtex1987 pushed a commit to semtex1987/govee2mqtt that referenced this pull request Aug 16, 2026
semtex1987
Merge PR 652: fix: add Govee 2FA login support
1a1982e 
Merges upstream wez#652 by florianhorner.
Fixes wez#647 by restoring undocumented Govee login when account 2FA is required.
@Gatorzgaming

Gatorzgaming commented Aug 20, 2026

Copy link
Copy Markdown

So I take it Wez hasn't responded to your messages yet?

I guess we the community will have to take over maintaining, and we'll need some rules and stuff so it doesn't become slopified or a package bloat supply chain nightmare.

I guess this is also opportunity for improving the project and we should probably prioritize the following

  • This PR
  • The two air quality monitors
  • The calling fans and other fans that are currently bugged

@miller79

miller79 commented Aug 22, 2026

Copy link
Copy Markdown

I have reached out to Wes on various channels and have not received any replies so it does seem like this project maybe abandoned. I'm good to fork and rename but I like waiting a full 6 months - year range just in case. It as that time is coming closer, we should discuss what that would look like in a separate issue.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Api Login from Home Assistant isnt working anymore.