Using long-lived access tokens to execute hassio commands over ssh

I’m trying to make it easier to start/stop/check the config of my instance via the command line and I can’t figure out how to make it work. My RSA keys are set up properly and I can ssh into the instance without a password. If I ssh into my hassio instance interactively, I can run all the normal hassio commands just fine:

$ hassio ha info
arch: amd64
boot: true

If I try to do the same thing via ssh (hassio ssh port is 222 for me):

$ ssh -p 222 root@server hassio ha info

I get this in the system log:

No API token provided for /homeassistant/info

If I generate a long-lived access token via my profile in the UI and retry:

$ ssh -p 222 root@server hassio --api-token "xxx" hassio ha info

I get this in the log:

Invalid token for access /homeassistant/info

I’m just using the exact LLAT string in this case, but I’ve also tried adding "Bearer " to the front without success. All the search results point to doing this via web calls, so maybe there’s some other syntax for using an access token on the command line?

1 Like

Is nobody using the --api-token option for hassio? I’m wondering if it actually works, or if I’m just using the wrong kind of token.

Solved my own problem. There are several ways to do it:

  • cURL

    • Create a LLAT by going to your profile in the Hass UI (circle at the top-level, scroll to the bottom, create a token)

    • Detailed instructions here on how to construct the request: Authentication API | Home Assistant Developer Docs

      Mine looks like this: (replace homeassistant/check with whatever command you want to run)

$ curl -X POST http://<server>:8123/api/hassio/homeassistant/check -H ‘Authorization: Bearer token_from_ui’

  • SSH to the hassio ssh addon

    • Follow the directions to install the basic ssh addon from the hassio addon store, pick a port, and add your RSA public key into the “authorized keys” section of the config

    • Log in via SSH using the port you chose, type “env” at the prompt and find the “HASSIO_TOKEN=xxx” line. That’s the token you need to use.

    • Run it like this (replace “ha info” with whatever command you want):

$ ssh -p port_number_from_addon root@server_name hassio --api-token “token_from_above” ha info

  • Build the hassio-cli executable and use it from anywhere
    • Generate long-lived access token as in the first option
    • Follow directions to download and build hassio-cli from here: GitHub - home-assistant/cli: 🔳 Home Assistant command line interface
      • When you build it with gox, make sure to specify the platform you need. That was -osarch="linux/amd64" for me, and the example at the link is for ARM.
    • Run it like this (change “ha check” to whatever command you want to run):

$ hassio --endpoint <server>:8123/api/hassio --api-token “token_from_above” ha check

In the end, I used the third option (build hassio-cli locally) and wrote a shell script to run it:

~/bin/hassio-cli \
–endpoint rcoleman-linux:8123/api/hassio \
–api-token “<long-lived-access-token?” \

and I call it “hassio”, so I can use the same command that I use from within the add-on:

hassio ha info

Let me know if you find any typos or have any questions.


fyi, if you have hass-cli already setup you should be able to do it like this too:

hass-cli raw post /api/hassio/homeassistant/check

…though I’ve never actually seen any output from a check call so I normally use things like:

hass-cli raw get /api/hassio/supervisor/info

I just saw hass-cli today but haven’t installed yet. I’ll check it out. ‘Check’ returns a simple ‘ok’ after a short wait if it’s all good or a bunch of errors if not. If you don’t see anything, it probably passed.

So far, I’m loving doing the check & restart from the command line. It avoids having to navigate the UI or keep a window open to the hassio cli.

Yeah, exactly why I work on hass-cli :slight_smile:

should add a specific hassio subcommand to make it even easier.

That’s awesome! It’s installed on my Linux machine and my Macbook and I’m playing with it now. I love it already.

Edit: I first used the homebrew installation method on my Mac, but it pulled what appears to be an old version that’s missing at least the “state” command. I switched to pip3 and it’s all good. I don’t know how the brew packages get updated, but it would be good to get it up to date.

im travelling at the moment so do please open bug on so not lost.