Tutorial: Using the new Auth system with tasker



Since the last update, I’ve had issues calling the Home Assistant API using my legacy password. It looks like a bug, but I thought it was time to switch to the new Auth system in my Tasker tasks.

After a bit of struggle, here is the best solution I’ve found, I hope it will help some people

1. Create a token

First of all, create a new “Long-Lived Access Token” at the bottom of the /profile page of your home assistant.


Save your Home Assistant address as well as your token in your global variables, like this:


2. Create a generic task

Create a new Task (I called it “Call HASS”) with a single action in it: JavaScriptlet

In the code part of the JavaScriptlet, paste the following

const url = global('%HA_ADDR') + local('par1');
const token= 'Bearer ' + global('%HA_AUTH');
const xhttp = new XMLHttpRequest();
xhttp.open('POST', url, false);
xhttp.setRequestHeader('Authorization', token);
if( xhttp.status != 200 ) { 
    console.error(xhttp.status + ' - ' + xhttp.responseText); 

Your task should look like this:

3. Call your task

Calling the Home Assistant API is now super easy!
In a new task, use the Perform Task Action, and fill the following:

  • The name of the previously created task in name (Call HASS in my example)
  • The URL to call in %par1
  • The JSON to send in %par2

That’s it!

I could have used a plugin such as RESTask to send HTTP requests with headers, but it seems a little bit overkill compared to these few lines of Javascript code.

Anyways, I hope my little tutorial will help people struggling with the new Auth system.

Have fun :+1:


thanks for the tutorial: it’s what I was looking for!

what about the HTTP GET and the commands without json payload (i.e: /shell_command/[name of the command])?

It’s called Perform Task. :+1:

1 Like

what about the HTTP GET and the commands without json payload (i.e: /shell_command/[name of the command])?

You can replace 'POST' with 'GET' in line 4, and replace xhttp.send(local('par2')); with xhttp.send(); in line 6.

I’m not sure how to store the response in a tasker variable tho. According to the documentation, you may just need to add var resp = xhttp.responseText; at the end to store the response in %resp, but I cannot make it work.

Edit: You cannot save the result to a local variable, but a global variable works.
Create %RESP in your variables, then add the following line at the end

setGlobal('RESP', xhttp.responseText);

Yeah I got a GET working with the RESTask plugin and setting/parsing the variable that way, but would prefer to do it via this method if possible (I hate more plugins, would love to do it “natively”). Anybody else have an idea?


Ok so you have to set the response variable as a global variable for it to work for a GET. I added a task to set “%response” to “%RESP” and was able to call that in another task. Happy to explain more if that doesn’t make sense.

Here’s my updated code:

const url = global('%HA_ADDR') + local('par1');
const token= 'Bearer ' + global('%HA_AUTH');
const xhttp = new XMLHttpRequest();
xhttp.open('GET', url, false);
xhttp.setRequestHeader('Authorization', token);
if( xhttp.status != 200 ) { 
    console.error(xhttp.status + ' - ' + xhttp.responseText);
if( xhttp.status == 200 ) { //successful http request
    var response = xhttp.responseText;

Where does the token go in the URL? I’m thinking of something like AutoTools JSON Read, which I use pretty frequently

It goes in the header, not the URL.

You can actually set the global variable in the script using setGlobal:

setGlobal('RESP', xhttp.responseText);

Ah nice. I was trying to figure that part out but couldn’t get it to work.

Hi all, I´m trying to update my tasks because at this moment I can turn on/off switches but cannot change boolean status. I set up the token and url on the GLOBAL variables, but when I run the task “CALL HASS” i have the following error

And if I run the Perform Task nothing happens, I can imagine because the previous error.

dont know if this is important but I´m using just http

Any clue? Thanks for the help

I’m using http and it works. Maybe try a new token

I followed this tutorial exactly and nothing happens when I call the task. Is there a suggestion for debugging? I’m using Home Assistant 0.83 with https using self signed certificate and got it to work using resTask, but I’d prefer this method.

Thanks so much. Did everything exactly as you posted, but it just isn’t working. I don’t understand what’s wrong. All my Tasker stuff has been broken for months now.

The line 9 of your script is not valid javascript, as said in the error.

Do you see errors in the /dev-info page of your Home assistant ?

Anyone got this working?
I get an error in tasker…just says line 7?

Works for me as it was posted.

Any chance those who’ve gotten it to work post their own screenshots? Maybe us who have issues can see something we’re doing wrong.