🌐 Show HA Community: We built OAuth for your home

[johndbritton (John Britton)]

@Tamsy

The idea that someone else I might not even know is managing devices in my private sphere is creepy!

I agree. The idea here is to grant limited permissions based on device and activity. For example a developer could request the ability to set the RGB value on a lighting device controller.

If the permission was granted, they wouldn’t know any of the following:

• How many lights are connected to the controller, if any.
• The location of the lights that they are able to control.
• The state or activity of the light.

Additionally, they wouldn’t be able to turn the light on or off. Only set the RGB value.

The user is in full control of what access they grant and to what parts of their home. For the developer, they get a unified API across device classes that is easy to develop against and test.

[johndbritton (John Britton)]

@CaptTom

There are HA options I use which are important to me, even though they’re only used by a small fraction of HA users. We shouldn’t discourage development of this type of thing.

@CaptTom I really appreciate this comment. I don’t think this is for everyone and I’m also not specifically making it for Home Assistant enthusiasts as the API will work across various home automation systems. I’m starting with Home Assistant and looking to get some developers to try out the API.

[johndbritton (John Britton)]

@mobile.andrew.jones

The idea is - this is a backend service and an authentication service right?

Exactly. This is a tool for developers to interact with their users’ connected devices with a unified API. Kind of like a mix of what Twilio does for phones and what Plaid does for finance applied to connected devices.

@mobile.andrew.jones

So a 3rd party app company could for instance create an app that lets you control your home (regardless of what technologies you have in your home), it would using your server, pop up a dialog asking what devices from Home Assistant you would like to allow access to, and then the 3rd party app would be able to control those devices.

Yes, and it’d be limited in access to only the devices and interactions you allow that particular app to do.

[johndbritton (John Britton)]

@HeyImAlex

Basically what he is describing is a generic programmatic remote interface to a HA instance. This is not to give people access, it’s to give programs access. The API could be leveraged by third party applications to access someones home automation system (or parts thereof). At least that’s the way I understand it. I personally don’t have a use for this myself, but I can absolutely see use cases in assistive technologies or remote third party monitoring systems here.

You nailed it. I’m working on the best way to explain it still. What’s most important is that applications can request access to particular devices and interactions on those devices.

Imagine for example an application that can automatically lock your house, but doesn’t have permission to unlock it.

[johndbritton (John Britton)]

@HeyImAlex

Yeah, HA does have the REST and WS APIs.

Additionally, they are only implemented by HA. This project’s aim is to support any home, with or without HA so that developers have a single API to use to interact with connected devices.

@HeyImAlex

The only thing that really put me off was all that stuff with registering and the secrecy part. Put it up on github. Open and generic APIs breathe on open discussion.

As of now there’s not much to put up on GitHub. I’m still in the discovery phase of what I’m building. I appreciate this feedback and will strive to work in the open. Right now I’m looking for anyone who thinks this is an interesting API so that I can build features they actually want.

[johndbritton (John Britton)]

@NathanCu

that is not answered by Matter’s Border Router + Multi Admin functionality.

I’m considering using Matter in my implementation and am following everything I can find on the subject closely.

The problem is since it’s not out there yet it’s hard to figure out exactly how everything fits together.

I still think that the the per device and per ability permission request model that I’m working on will provide added functionality for developers and benefit the end user with better privacy and security.

@NathanCu Do you have any pointers or recommended readings on the topic of matter multi-admin and border routers?

[johndbritton (John Britton)]

@Edwin_D

Also, you’re connecting outside in, instead of inside out it seems. That is yet another security problem I’d like to avoid.

This is a good point. I’m connecting outside in just in this proof of concept, I will change this in the future.