🔒 Alarmo Link - Arm and Disarm Alarmo from a Private Link - No Account, No App

Blueprints Exchange
,
1

Alarmo Link

Arm and disarm Alarmo from a private link, no Home Assistant account and no app: one automation per person, so adding someone means creating one and revoking them means deleting it.

Import Blueprint

Open your Home Assistant instance and show the blueprint import dialog with a specific blueprint pre-filled.

Some of the people who live in my home do not use Home Assistant, and I still want them to be able to set the alarm. Same for a cleaner or a house sitter: they should be able to arm and disarm, and nothing else. Handing out a user account for that felt like too much, and asking someone to install an app they will open twice a week felt like too much as well.

So this gives each person a URL. They open it, they see two buttons.

2026-08-15-screenshot-knopfseite
2026-08-15-screenshot-knopfseite760×1240 20.5 KB

Add someone → create an automation from this blueprint. Remove someone → delete it. Their link stops working immediately and nobody else is affected.

:warning: This needs a companion page

Unusual for a blueprint, so let me be upfront: the blueprint alone does nothing you can tap. It handles two webhooks. The buttons live in a single HTML file that you copy into config/www/.

Both are in the repo, they share a version number, and neither works without the other:

GitHub Repository: home-assistant-blueprints/alarmo-link at main · HubEight/home-assistant-blueprints · GitHub

What you need

  • Alarmo with at least one user who has a code
  • Home Assistant 2024.10 or newer
  • Home Assistant reachable from outside your network, over HTTPS

Setup

  1. Copy alarmo-link.html to config/www/alarmo-link.html
  2. Import the blueprint with the badge above
  3. In Alarmo, give the person their own user and code — Alarmo’s history names the user the code belongs to, so a shared code names the wrong one
  4. Open https://<your-ha>/local/alarmo-link.html with no # in the address. That is a setup screen: it generates a pair of webhook IDs with crypto.getRandomValues and shows you the finished link

2026-08-15-screenshot-einrichtung
2026-08-15-screenshot-einrichtung760×2040 111 KB

  1. Paste the two IDs into the blueprint, add the name and the Alarmo code, save
  2. Send the person the link. Add to Home Screen turns it into a full-screen icon

Optionally the link carries the alarm’s name and a language, both independent: #<arm>,<disarm>[,<name>][,<language>]. The heading, the tab title and the home screen name follow the name; English and German are included and anything else falls back to English.

Security — please read this part

The link is the password. There is no login. Anyone holding the URL can arm and disarm, so share it the way you would share a house key. Some deliberate choices behind that, and some honest limits:

  • The IDs sit in the URL fragment (after #), which browsers never send to the server, so loading the page logs nothing secret. Pressing a button does: the request goes to /api/webhook/<id>, and any reverse proxy in front of Home Assistant records that path. I checked mine and found working keys to my own alarm sitting in Traefik’s access log. Keep its retention short and never paste it into a support thread.
  • The webhooks accept POST only, on purpose. Messengers fetch URLs to build link previews. A GET webhook would trip the alarm the moment you sent someone the link.
  • 192 bits per ID, from the browser’s cryptographic random source. Nothing is transmitted while you generate them.
  • No API token in the page, which is why it says “Arm command sent” rather than showing the alarm’s real state. Showing real state would mean putting a token in a page that has no login — that is full access to Home Assistant, for a two-button panel. Not worth it.
  • A revoked link still reports success. Home Assistant answers 200 OK for a webhook it does not know, deliberately, so nobody can probe which IDs exist. The page cannot tell that apart from a real success. This is why the notification option matters: two seconds after the command it reports what the panel actually did, and it is the only confirmation there is.
  • No expiry, and a link cannot be told apart from a copy of it. If one may have leaked, replace both webhook IDs in that automation. That is the whole revocation story.

If your threat model does not tolerate a bearer link, this is not for you, and that is a fair call to make.

Options

Section Input
Person Name required Shown in the notification, so you can tell who switched the alarm
Alarmo code required The Alarmo user these actions are booked under
Link Webhook ID – arm required From the setup screen, or your own random string
Webhook ID – disarm required Must differ from the one above
Alarm Alarm panel required Your Alarmo alarm_control_panel entity
Arm mode optional Away, Home or Night — default Away
Notification optional Reports the real state two seconds after the command

Feedback Welcome!

Please let me know if you find any bugs or have suggestions for improvements! :slightly_smiling_face: