Relevant which is the master?

[fuse]

There is no difference between inclusion using the button on Z-Stick and including the node through the Z-Wave panel using add_node in HASS. Both methods will result in an unencrypted inclusion of the node.

If your device supports the Security CC (Security S0) it’s recommended to set an encryption key in options.xml and perform a secure inclusion using the add_node_secure service under the Z-Wave domain or in OZWCP. This requires Z-Stick to be plugged to the relevant hardware as the Z-Stick itself does not store the key.

Adding Security Devices to OZW:

Home

HASS documentation - Add security devices

Z-Wave

A couple of my responses from another thread:

Correct way to add ZWave devices?

If you want to perform a secure inclusion of a node using OZW, the Z-Stick has to be connected to the USB port. This is because the security key is added and handled within OZW, not within the Z-Stick. The button on the Z-Stick is great for quick exclusions, but only performs regular, non-encrypted inclusions. If your device supports the S0 Security CC, make performing inclusions over USB a habit. There are two ways of performing proper inclusions. Call the zwave/add_node_secure service stra…

Correct way to add ZWave devices?

My usual routine when adding Z-Wave devices through the HASS interface is: Kepp track of (or verify) the most recent node ID that was added. I make small notes of the node ID and personal device identifier in my Z-Wave device configuration file to make life easier. Add the node. Go to Developer Tools -> States. CTRL+F and search for the assumed new node ID, eg “node_id: 40”. Verify it’s listed. If you’re not using a default view (‘default_view: yes’ in configuration.yaml) the new device(s) is …