Google Assistant component, failed to setup. 401 error

I follow guide here Google Assistant - Home Assistant but it failed in step 7. It show this error on my Android phone:

  1. That’s an error.

Your client does not have permission to the requested URL /services/auth/handoffs/auth/complete?return_url=assistant-handoff://complete. That’s all we know.

I use api_password and the port of HA is 443, it can access from the internet.

what is your ha port? use that port for google_assistant

It is 443, the config:
http:

  api_password: passsword
  server_port: 443
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem
  ip_ban_enabled: True
  login_attempts_threshold: 5

how do you put your base_url: ?

I don’t use it in the config file

can you use google tts ? So I assume you cannot use google tts as well. Put like this cut away the server_port:443, then you will be able to use google tts and also google_assistant

http:
  base_url: https://yourdomain.duckdns.org:443
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem
  ip_ban_enabled: true
  login_attempts_threshold: 3

in gaction

“url”: “https://yourdomain.duckdns.org:443/api/google_assistant/auth?api_password=yourhapassword”

HA itself use port 8123 / this should give you the same result if you said you can access ha with 443 port. However, I believe that ha just forward the port from 443 to 8123

Thank you, it is still the same. I am test the Google TTS. When i do it your guide, it show this on the HA console:

missing redirect_uri field
3:48 PM components/google_assistant/auth.py (WARNING)

tts can be use with google. You can use this with or without let’s encrypt.

google_assistant component. if you can show your google_assistant config and your gaction project.json then I might be able to help.

This is my google_assistant config:

google_assistant:
  project_id: my_project_id
  client_id: 80_long_string1
  access_token: 80_long_string2
  exposed_domains:
    - switch
    - light
    - group

project.json:

{
  "actions": [{
    "name": "actions.devices",
    "deviceControl": {
    },
    "fulfillment": {
      "conversationName": "automation"
    }
  }],
  "conversations": {
    "automation":
    {
      "name": "automation",
      "url": "https://my_name.duckdns.org:443/api/google_assistant"
    }
  }

This is for google_assistant

  project_id: !secret google_project_id <== google will provide after you build action sdk. Dont worry if you build action sdk and project itself put in smart home project (not show action sdk) and also give you different project name. example you create projectABC, google might give you braveprojectABC <== use this as project_id
  client_id: !secret google_client_id  <== this create from your ssh
  access_token: !secret google_access_token   <== this create from your ssh
  agent_user_id: !secret google_agent_user_id  <== this I use email. The same email I put in ADD Scope / the email I create the project
  api_key: !secret google_homegraph_api_key  <== follow the step you will get api_key to put
  exposed_domains:
    - switch
    - light
    - group

this is for gaction
“url”: “https://yourdomain.duckdns.org:443/api/google_assistant/auth?api_password=yourhapassword”

for configuration.yaml / if you put like this you will be able to use google tts from internal and external network.

http:
  base_url: https://yourdomain.duckdns.org:443   <=== very important to put with port because tts won't read port from another line and it read from base_url:
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem
  ip_ban_enabled: true
  login_attempts_threshold: 3

by fullfill all these then you can use google_assistant and tts google

Yes, i following all the guide and it not work. I test Google TTS and it work.

Ok. google tts works now.

So I see from your google_assistant config. you need
agent_user_id <== although the tutorial said it will provide but only if you can connect. Since you can’t connect give it the right email you want to use google_assistant.
api_key <== this to link and re-link the account. when you add more devices in google_assistant, it won’t load automatically. you have to re-link and link again if you only use with google_assistant from phone. unless you have physical google home then you can say discover my device (I never use).

Everytime you make change to HA. Don’t forget to reboot.

Yes, i have add all and reboot, still not work. I use hass.io 0.64.3 seem there are some bug

I just update to 0.64.3 still works fine. The different is I use hassbian. But I’m sure the setting is the same.

From your router did you forward port 443 to 8123
and port 8123 to 8123

the error of auth.py <=== you should check the client_id, acess_token and user_agent_id

I can access it outside and port forward only 443 to 443 and 22 to 22 for ssh. Because i config ha to use only port 443.

http:
  base_url: https://myaddress.duckdns.org:443
  api_password: mypass
  server_port: 443
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem
  ip_ban_enabled: True
  login_attempts_threshold: 5
http:
  base_url: https://myaddress.duckdns.org:443
  api_password: mypass
#  server_port: 443
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem
  ip_ban_enabled: True
  login_attempts_threshold: 5

Then the setting of url for google_assistant shouldn’t be a problem. the problem is client_id, access_token and user_agent_id to check

Can you share your configuration part about http: and google_assistant: ? Additional the setting forward in your router. It take me some hours without success, i also try to delete console project and create a new one.

sorry, I just got back from outside. from my google_assistant

  project_id: !secret google_project_id  <== name given by google after you have create the project, not the name you create
  client_id: !secret google_client_id  <==  I got from ssh, guide in google assistant component page "$ cat /dev/urandom | fold -w 120 | head -n 1 | base64 -w 0 | tr -dc '0-9A-Za-z' | cut -c -80"
  access_token: !secret google_access_token  <==  I got from ssh, guide in google assistant component page "$ cat /dev/urandom | fold -w 120 | head -n 1 | base64 -w 0 | tr -dc '0-9A-Za-z' | cut -c -80"
  agent_user_id: !secret google_agent_user_id  <== I put email address that create the project
  api_key: !secret google_homegraph_api_key  <== from google_homegraph
  exposed_domains:
    - switch
    - light
    - scene
    - script
    - media_player
    - climate
    - cover
    - fan
    - group

in gaction: project.json

{
  "actions": [{
    "name": "actions.devices",
    "deviceControl": {
    },
    "fulfillment": {
      "conversationName": "automation"
    }
  }],
  "conversations": {
    "automation" :
    {
      "name": "automation",
      "url": "https://mydomain.duckdns.orgt:8123/api/google_assistant"
    }
  }
}

Account linking in step 3.3, if you could see step 3. Authorization URL
I put https://mydomain.duckdns.org:8123/api/google_assistant/auth?api_password=myhapassword
step 3.4 ADD Scope (this is during you create action sdk). I put email that create project (the email I use for google_assistant), and name.

When you get to the page TEST DRAFT. DO NOT SUBMIT DRAFT FOR REVIEW. You can just close the page

my http:

  base_url: !secret base_url  <== this is https://mydomain.duckdns.org:8123
  api_password: !secret api_password  <== homeassistant password
#  server_port: !secret server_port  <== I didn't use it, so I put # in front.
  ssl_certificate: /etc/letsencrypt/live/mydomain.duckdns.org/fullchain.pem 
  ssl_key: /etc/letsencrypt/live/mydomain.duckdns.org/privkey.pem
#  cors_allowed_origins:
#   - https://google.com
#   - https://home-assistant.io
#  use_x_forwarded_for: true
#  trusted_networks:
#   - 192.168.1.0/24
  ip_ban_enabled: true
  login_attempts_threshold: 3

my router port forward is 443 to 8123, and 8123 to 8123

Thank you. Final i can link it, it is because Chrome browser on Android 8.0, it prevent redirect. So i manual copy it to Samsung browser (i use Galaxy S8) and it work. This take me and you many hours