Recently, about an week or so ago, Shelly introduced Shelly Plug M Gen3 so this seems to be brand new device. I have bought 16 of these but I am having problem to add them to HA. Basically when I provide IP address of the device in HA it forward to password message box but then i try to enter correct password i get “Invalid authentication”. With that password i can login into administration panel. I have tried to add few of these to HA but all get “Invalid authentication” message when I try to provide password.
There is also 1.8.99-plugmg3prod0 in the footer of Administration Panel.
I have noticed that when there is no password for Admin Panel set then you can add the plug to HA without any issues. Just password protected Plug M Gen3 seems to fail.
The upcoming firmware version 1.8.0 introduces changes to authorization that are currently not supported by aioshelly package and Shelly integration. You must disable the password on the device to integrate it with Home Assistant.
Is there a issue on github or something similar I could track so I get noticed when the Shelly integration gets updated to work with the new authorization?
I tried looking into the issue on a technical level, put a simple password on one of my shelly plug m devices, and with curl I am able to fetch the data the same way as with my (supported) Plug S devices (needles to say the password in this example is only temporarily ):
stefan@Stefan-Framework16:~$ curl -v --digest -u 'admin:foobar' http://192.168.30.29/rpc/Switch.GetConfig?id=0
* Trying 192.168.30.29:80...
* Connected to 192.168.30.29 (192.168.30.29) port 80
* Server auth using Digest with user 'admin'
> GET /rpc/Switch.GetConfig?id=0 HTTP/1.1
> Host: 192.168.30.29
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 401 Unauthorized
< WWW-Authenticate: Digest qop="auth", realm="shellyplugmg3-0892724ca9b0", nonce="AAAAAGnKO49whCKHVjGH2R+Wonof1v2g8QogdrSZRbuB5ue/Qdvmt9QhNH+iWPWU", algorithm=SHA-256
< Content-Length: 0
< Cache-Control: no-store
< Server: ShellyHTTP/1.0.0
< Connection: close
<
* Closing connection
* Issue another request to this URL: 'http://192.168.30.29/rpc/Switch.GetConfig?id=0'
* Hostname 192.168.30.29 was found in DNS cache
* Trying 192.168.30.29:80...
* Connected to 192.168.30.29 (192.168.30.29) port 80
* Server auth using Digest with user 'admin'
> GET /rpc/Switch.GetConfig?id=0 HTTP/1.1
> Host: 192.168.30.29
> Authorization: Digest username="admin", realm="shellyplugmg3-0892724ca9b0", nonce="AAAAAGnKO49whCKHVjGH2R+Wonof1v2g8QogdrSZRbuB5ue/Qdvmt9QhNH+iWPWU", uri="/rpc/Switch.GetConfig?id=0", cnonce="YjQ2YjJjYzZlYzJjZWM3ODNjZTk5ZmFkZjFkZGExZWY=", nc=00000001, qop=auth, response="2ddb7cab3d54023ecfcf28525cb59fc2bca4978bf2571695763ea158f4c6ae1a", algorithm=SHA-256
> User-Agent: curl/8.5.0
> Accept: */*
>
< HTTP/1.1 200 OK
< Content-Type: application/json
< Content-Length: 237
< Server: ShellyHTTP/1.0.0
< Connection: close
<
* Closing connection
{"id":0, "name":null,"initial_state":"on", "auto_on":false, "auto_on_delay":60.00, "auto_off":false, "auto_off_delay":60.00,"power_limit":3000,"voltage_limit":280,"autorecover_voltage_errors":false,"current_limit":13.000,"reverse":false}stefan@Stefan-Framework16:~$
Home Assistant Core only logs this:
2026-03-30 09:50:52.903 WARNING (MainThread) [homeassistant.config_entries] Config entry ‘shellyplugmg3-0892724ca9b0’ for shelly integration could not authenticate: Authentication failed for shellyplugmg3-0892724ca9b0, please update your credentials
I would like to have all my devices password protected, so if I can do anything to help out?
The integration communicates with devices via WebSocket, not regular requests. If I remember correctly, the problem was that the device required a new authentication for each WS frame, which significantly reduced communication performance on the aioshelly side. The Shelly team was supposed to implement firmware changes related to this, which will be available when firmware 1.8.0 beta is released.
Thanks for the explanation. It seems like the plug M’s I ordered from Shelly directly are deployed with v1.8.99 and I can’t see to find a firmware download online to possibly downgrade it to 1.7.*
In this case, I suppose there’s nothing more I can do then wait regretfully.
I just received the same device Shelly Plug M and firmware by default same as yours 1.8.99-plugmg3prod0. I just scanned QR from box than installed Shelly app. After that it added device to Shelly app and right after that it offered me add this device to some other apps and I chose Home Assistant automatically installation - so, it said that creating credentials for HA and than successfully completed. JFY HA version 2026.3.4. So, you can try to remove everything and try again. It should work.
Same issue here ! Firmware is the same 1.8.99-plug3prod0. If you install via the QR-code it adds the device without a password to HA. if you set a device-password later authentication fails ! All Plug S devices are working fine. Firmware is the same 1.8.99-plug3prod0.
For me this is resolved by upgrading the Shelly Plug M gen 3 to firmware version "20260423-102609/2.0.0-beta1".
There's no stable version currently available that works properly with Home Assistant being password protected so it seems. Hopefully v2 will become stable soon.
Nope, that doesn't work for me. Still cannot add the Shelly Plug M Gen3 to HA with an Devicepassword... . We have 2026 and Passwordauthentication is something special... insane. Sorry but those shellys (4 pieces) wait now 2 Months to get ready to start working. maybe in the next 3 months this magic will start to work...
20260423-102609/2.0.0-beta1-g8c7700a still fails to join home assist, when password is set in Shelly Plug M Gen3.
Current Version is 1.8.99-plugmg3prod0 which also fails
I don’t know anything more about it.