Varco lets external apps or dashboards talk to Home Assistant without ever handing them a long-lived access token, and without needing Home Assistant to be reachable from the public internet.
A consumer app requests a narrow, scoped grant. As the HA owner, you approve or reject it from the Varco admin panel. From then on, Home Assistant itself enforces that grant on every read, subscription, history query, camera snapshot, and service call.
Why
Assume one of the following use cases:
You go on vacation and you want to give your neighbour the ability to enter your home for a limited time by sharing only lock.front_door and lock.external_gate
You want to create an external HTML rich dashboard to run in kiosk mode (using just the browser)
You run an airbnb and want to give your guests the ability to interact with climate, lights etc for a limited time frame -> demo
You would like to publicly share read only access to some entities (no action,scripts,service calls etc)
You want to provide access to AI-LLMs to your home assistant but narrowing down the possibilities. Eg LLM cannot fetch camera.* or interact with lock.front_door etc.
You have a regular cleaning service that comes every Tuesday at 09 and want them to have the ability to interact with covers, locks, etc only Tuesday's between 09 and 12.
Key ideas
Consumers never receive a Home Assistant token.
No inbound public URL is required for HA.
Grants are bound to a consumer's public key and stored inside Home Assistant.
HA stays the authority for consent, policy checks, service calls, and audit.
A relay (Cloudflare Worker + Durable Object) just routes encrypted envelopes ... it makes no permission decisions.
Revocation is enforced for active and future sessions.
All data is e2e encrypted and when possible the relay gets bypassed by establishing P2P via WebRTC.
Outro
A heads-up: this is an early MVP / prototype. The core pieces are implemented and covered by tests, but the API and grant model may still change. Feedback and ideas very welcome!
The whole project is LLM friendly so having claude/gpt build a dashboard or a project using varco as connection layer should be super easy.
The role of the relay server is to facilitate the communication between the consumer and ha. When a consumer wants to talk to a specific Home Assistant it asks the relay server if that HA is connected to it. If it is then a P2P connection consumer<->HA is attempted with WebRTC which allows for NAT traversal using a public TURN server.
If webrtc can be established then any further communication between the consumer and HA is direct and P2P.
If for some reason the direct connection cannot be established, then the bridge acts as a packet-forwarder. All that the bridge knows is the destination of the packets but the content is fully e2e encrypted using asymmetric encryption. This means that the bridge can never:
Read the content of the packets
Read or execute anything on HomeAssistant (no matter the grant that was allowed to the consumer)
So in just few words the bridge is there as a fallback mechanism. You can see this in the demo. Check out the upper-right corner. It'll either say Relay or P2P. the underlying home assistant behind that demo is behind a NAT (and chances are that you are also behind a nat when trying to connect).
PS: the data you see in the demo lives in a real Home assistnat, but that installation has synthetic data and lights so you can try as much as you like (also trying to open multiple tabs to check the delay)
PPS: You dont need to allow a connection from a 3rd party server. Its your HA that connects (and maintains the connection) to the relay server.
PPPS: I actually encourage everyone to setup a free relay server of their own so they can also prevent any possible data collection. Even if bridge can't read the packets due to encryption, it's always a best practice to own your own data. Since the bridge is well within the cloudflare free usage limits, it's a no-brainer to me.
I looked this over and it does appear very promising, but I noticed it doesn't do any of the rendered site hosting itself. This would be a lot easier to use if there was some sort of site builder that would handle the rendering, especially if it could consume lovelace. I very much want something tightly scoped for my rental properties, but I'm not a front end developer at all. Building dashboards in Lovelace is easy, but having to build out something that is then hosted somewhere makes it a lot more difficult.
Hey @tykeal, thanks for your message. I am working towards the first step that would ultimately give you teh ability to (more or less) share a dashboard through varco.
