Nest Protect integration for Home Assistant looses authentication after home assistant restarts

[channafam]

The problem

Nest Protect integration for Home Assistant looses authentication after every home assistant restart. This issue only started recently.

It’s seems I need to gather issue token and cookies after each restart. Gathering the details now seems to work intermittently. Following the instructions provided https://github.com/iMicknl/ha-nest-protect/tree/beta#retrieving-issue_token-and-cookies, the gathered token and cookie does not always work. Seems I need to follow procedure multiple times before on combination is finally accepted and allows authentication

What version of this integration (ha-nest-protect) has the issue?

0.4.0b5

What version of Home Assistant Core has the issue?

2024.7.0 And previous 2 versions

Device / Model

Nest Protect

Diagnostics information

No response

Home Assistant log

Logs

Copy/paste any log here, between the starting and ending backticks (`)

Additional information

@iMicknl - any thoughts?
No response

[atharayanil]

I am having an identical issue; HA is running off a dedicated NUC [no docker]

[horse-pants]

I'm having the same issue, except tonight no combinations of token / cookie will work

[prenazol]

Same hre: tried several times and the cookies moethod works randomly and whe it works HA looses authentication after a restart.
Never had such issue in the past year.

[channafam]

@ViPeR5000 , and @iMicknl - any suggestions?

[atharayanil]

follow up -- I was able to eventually get this reauthenticated and it's been stable/signed in for 7+days

[jaburges]

using the beta (and master) but after restart I get the LOGGED_OUT issue

[iMicknl]

@channafam I don't have any suggestions at the moment.

[millerim]

This has been happening to me also. I was able to authenticate using the documented procedure, but only once and not since. I keep getting "Unexpected error". Any advice is appreciated.

This seems to be the relevant log entry:

2024-09-01 12:34:04.285 ERROR (MainThread) [custom_components.nest_protect] Flow aborted: already_in_progress
Traceback (most recent call last):
File "/config/custom_components/nest_protect/config_flow.py", line 102, in async_step_account_link
[issue_token, cookies, email] = await self.async_validate_input(
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/config/custom_components/nest_protect/config_flow.py", line 64, in async_validate_input
await self.async_set_unique_id(nest.user)
File "/usr/src/homeassistant/homeassistant/config_entries.py", line 2389, in async_set_unique_id
raise data_entry_flow.AbortFlow("already_in_progress")
homeassistant.data_entry_flow.AbortFlow: Flow aborted: already_in_progress

UPDATE: I was able to authenticate by deleting all the re-authentication prompts. I didn't have to delete the integration itself. I'm guessing that it can't support more than one authentication flow at a time?

[hausmanconsulting]

This just happened to me as well (I've restarted HA many times in the last month or so and this is the first time I've lost my Nest authentication; I'm still on HA 2024.5.3, no recent updates there).

I wasn't 100% sure what @millerim meant by "deleting all the re-authentication prompts" but when I obtained a new issue token and cookies, I got an error about "invalid flow" when I tried entering them in the authentication popup that showed up when I initially restarted HA. So I closed that popup (which I think is what @millerim was referring to) and I went to settings - integrations - Nest Protect, and selected "Add Entry". Entering my new credentials there worked.

[millerim]

To clarify: each re-authentication entry in the integration page had a “kebab” menu with the option to delete the integration. I deleted both of them and was able to re-authenticate once they were gone.

…

On Sep 2, 2024, at 7:53 PM, Haus ***@***.***> wrote: This just happened to me as well (I've restarted HA many times in the last month or so and this is the first time I've lost my Nest authentication; I'm still on HA 2024.5.3, no recent updates there). I wasn't 100% sure what @millerim <https://github.com/millerim> meant by "deleting all the re-authentication prompts" but when I obtained a new issue token and cookies, I got an error about "invalid flow" when I tried entering them in the authentication popup that showed up when I initially restarted HA. So I closed that popup (which I think is what @millerim <https://github.com/millerim> was referring to) and I went to settings - integrations - Nest Protect, and selected "Add Entry". Entering my new credentials there worked. — Reply to this email directly, view it on GitHub <#341 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/AHGOIXHW5NJL4NW3PLCVDYLZUT253AVCNFSM6AAAAABKKLW2H2VHI2DSMVQWIX3LMV43OSLTON2WKQ3PNVWWK3TUHMZDGMRVGM4TAOJQGU>. You are receiving this because you were mentioned.

[nielssteenvoorde]

This has been happening to me also. I was able to authenticate using the documented procedure, but only once and not since. I keep getting "Unexpected error". Any advice is appreciated.

This seems to be the relevant log entry:

2024-09-01 12:34:04.285 ERROR (MainThread) [custom_components.nest_protect] Flow aborted: already_in_progress Traceback (most recent call last): File "/config/custom_components/nest_protect/config_flow.py", line 102, in async_step_account_link [issue_token, cookies, email] = await self.async_validate_input( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/config/custom_components/nest_protect/config_flow.py", line 64, in async_validate_input await self.async_set_unique_id(nest.user) File "/usr/src/homeassistant/homeassistant/config_entries.py", line 2389, in async_set_unique_id raise data_entry_flow.AbortFlow("already_in_progress") homeassistant.data_entry_flow.AbortFlow: Flow aborted: already_in_progress

UPDATE: I was able to authenticate by deleting all the re-authentication prompts. I didn't have to delete the integration itself. I'm guessing that it can't support more than one authentication flow at a time?

Worked for me as well. TNX for sharing ;-)

[realsby]

Is it possible to have an integration by using google username, password and OTP secrets? @iMicknl
If we have such option, maybe we can add a dummy user to our Google Home system which can also access to NEST.

It's really started annoying to re-enter cookies every week.

[iMicknl]

Not that I am aware. If someone figures out how to get an access token, I am happy to implement this. The cookie method was a community contribution as well.

[goncalossilva]

Same issue. I can authenticate successfully every time, but I'm hoping I don't have to go through the cumbersome project after every home assistant restart!

[kingswindsor]

I've upgraded to the latest release (thank you) but can confirm that I'm still finding the problem of losing authentication at each HA restart. As I seem to get an average of one update each day, the re-authentication is becoming a major chore.

What I don't get is what changed about 6 months ago? Before that the cookie method authentication persisted between restarts and life was easy:)

I can try and look at logs but which would be the right ones to look at?

P.S. I also use Homebridge with the Nest Protect plugin and the cookie method fails on HA re-start as well. So it might be intrinsic to the cookie method... or did something else change.

[cmcs]

Same here, I feel that I should just ignore it but every time I can't seem to resist pasting in the URL & Cookie to fix it!

[kingswindsor]

Same here, I feel that I should just ignore it but every time I can't seem to resist pasting in the URL & Cookie to fix it!

I know, I like to tidy things up and, also, it is a safety device so I like to keep them connected.

[51av0sh]

In my case, reloading the integration brings it back every time.

Unknown exception. Please create an issue on GitHub with your logfile. Updates paused for 5 minutes. Traceback (most recent call last): File "/config/custom_components/nest_protect/__init__.py", line 164, in _async_subscribe_for_data auth = await entry_data.client.get_access_token() ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/config/custom_components/nest_protect/pynest/client.py", line 92, in get_access_token await self.get_access_token_from_cookies(self.issue_token, self.cookies) File "/config/custom_components/nest_protect/pynest/client.py", line 159, in get_access_token_from_cookies raise BadCredentialsException( f"{result["error"]} - {result["detail"]}" ) custom_components.nest_protect.pynest.exceptions.BadCredentialsException: USER_LOGGED_OUT - No active session found.

[51av0sh]

I just realized it doesn't happen on restarts for me. I just restarted and the integration is working fine. I do get the USER_LOGGED_OUT every day and reloading works. Need to figure out a way to automate the reloads since the entities still show available they just don't update until I reload (and I get the USER_LOGGED_OUT message in the logs). Seems like something is timing out.

[cmcs]

This issue no longer occurs for me. Previously, every restart broke the integration. In the past few weeks it has not recurred despite many restarts. I didn't take any specific action to resolve it, but I have been keeping my homassistant docker image up to date.

[goncalossilva]

Same for me. It appears to be gone.

[geertmeersman]

Strange, mine still breaks. Running on the latest HA version 2025.1.4 and version 0.4.0 of the integration...
Are you guys using a beta version?

[horse-pants]

Mine also still breaks, running the latest of everything

[cmcs]

Strange, mine still breaks. Running on the latest HA version 2025.1.4 and version 0.4.0 of the integration... Are you guys using a beta version?

I'm not on a beta, on exact same versions you quoted.

[kingswindsor]

Joyously, my cookie details now seems to persist through restarts - running HA 2025.2.0 and the integration at 0.4.0. Hope it stays like that!

[geertmeersman]

No joy here ... still breaking with 2025.2.0 after a restart (not an immediate restart, after a while)

[iMicknl]

The problem is most likely not linked to the HA code and restart, but to your Nest session. If the cookie is invalidated, you will be prompted to re-login.

This cookie method is very far from ideal and I don't have much insights on how/when these cookies are invalidated.

[geertmeersman]

Understood, but the thing is that I capture the issueToken url & cookie from my PC, don't sign out of the nest session, after a while restart HA and it breaks. If I then go to home.nest.com, my session is still active.
No idea how/where it gets invalidated, but I understand you don't have the insights :-)

[geertmeersman]

With debug on I already see this error:

2025-02-11 13:07:12.789 ERROR (MainThread) [custom_components.nest_protect] Unknown exception. Please create an issue on GitHub with your logfile. Updates paused for 5 minutes.
Traceback (most recent call last):
  File "/config/custom_components/nest_protect/__init__.py", line 183, in _async_subscribe_for_data
    result = await entry_data.client.subscribe_for_data(
             ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    ...<4 lines>...
    )
    ^
  File "/config/custom_components/nest_protect/pynest/client.py", line 317, in subscribe_for_data
    async with self.session.post(
               ~~~~~~~~~~~~~~~~~^
        f"{transport_url}/v6/subscribe",
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    ...<10 lines>...
        },
        ^^
    ) as response:
    ^
  File "/usr/local/lib/python3.13/site-packages/aiohttp/client.py", line 1425, in __aenter__
    self._resp: _RetType = await self._coro
                           ^^^^^^^^^^^^^^^^
  File "/usr/local/lib/python3.13/site-packages/aiohttp/client.py", line 721, in _request
    timeout_ceil_threshold=self._connector._timeout_ceil_threshold,
                           ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
AttributeError: 'NoneType' object has no attribute '_timeout_ceil_threshold'
2025-02-11 13:07:12.792 ERROR (MainThread) [homeassistant] Error doing job: Unclosed connection (None)
2025-02-11 13:07:12.792 ERROR (MainThread) [homeassistant] Error doing job: Task exception was never retrieved (None)
Traceback (most recent call last):
  File "/config/custom_components/nest_protect/__init__.py", line 157, in _async_subscribe_for_data
    entry_data: HomeAssistantNestProtectData = hass.data[DOMAIN][entry.entry_id]
                                               ~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^
KeyError: '01JKEE59EF0E0T2SPTTAAGSS7X'

[GSzabados]

Could you try to delete the integration from HA? Not removing the custom component itself, but deleting all the devices, so the integration wouldn't be active, then a HA restart, and try to add the Integration, but this time doing the authentication through an incognito window?

My assumption, that the authentication, cookie and token changes, because the logged in session doesn't go "headless" like in incognito mode, when the browser window closed.

If you have issues logging into on the Nest page, then you need to activate 3rd party cookies in incognito mode, as I remember. But that should be written in the instructions.

[GSzabados]

File "/usr/local/lib/python3.13/site-packages/aiohttp/client.py", line 721, in _request
timeout_ceil_threshold=self._connector._timeout_ceil_threshold

I will have another look at this. That seems to be odd, why that would be a NoneType object.

[geertmeersman]

File "/usr/local/lib/python3.13/site-packages/aiohttp/client.py", line 721, in _request
timeout_ceil_threshold=self._connector._timeout_ceil_threshold

I will have another look at this. That seems to be odd, why that would be a NoneType object.

Perhaps it's linked to the reauth. Perhaps when he reauthebticates he creates a new entry?

[geertmeersman]

Could you try to delete the integration from HA? Not removing the custom component itself, but deleting all the devices, so the integration wouldn't be active, then a HA restart, and try to add the Integration, but this time doing the authentication through an incognito window?

My assumption, that the authentication, cookie and token changes, because the logged in session doesn't go "headless" like in incognito mode, when the browser window closed.

If you have issues logging into on the Nest page, then you need to activate 3rd party cookies in incognito mode, as I remember. But that should be written in the instructions.

So have done it with the incognito window (btw the cookie value is way smaller than without the incognito).
Until now it seems to work fine, after 1h I did a reboot and still authenticated.

Will provide a new update later on today, but crossing fingers

[geertmeersman]

@GSzabados I confirm that this works.

So everyone, you need to get the issuetoken & cookies from an incognito browser session.

@iMicknl , perhaps updating the Readme? => Update, it's already in the readme! Perhaps making it stand out? Thx

[horse-pants]

This also appears to work for me, I had tried removing the config before, but without doing it in incognito and that didn't help, incognito seems to be the solution

Thanks to all involved

[51av0sh]

Incognito was the route I took from the beginning. The USER_LOGGED_OUT error is happening every 1-2 hours. I have setup a command line sensor to track the error in the logs (runs every 60 seconds) and use that to reload the integration automatically so I do have a working integration thanks to this automation but still trying to figure out the issue. I'll enable debug to get more details on the error right before this one.

I have 3 protect devices

[GSzabados]

Incognito was the route I took from the beginning. The USER_LOGGED_OUT error is happening every 1-2 hours.

Could you try my suggestion from a few posts above? But when you finished setting up the integration and got the token and cookie, please close the incognito window, without logging out there, just closing it. I assume you did the incognito window log-in on a PC and not a phone, bit if you did it on a phone, could you try it on a PC?

[51av0sh]

Incognito was the route I took from the beginning. The USER_LOGGED_OUT error is happening every 1-2 hours.

Could you try my suggestion from a few posts above? But when you finished setting up the integration and got the token and cookie, please close the incognito window, without logging out there, just closing it. I assume you did the incognito window log-in on a PC and not a phone, bit if you did it on a phone, could you try it on a PC?

Yes that's correct I did it on a PC and closed the incognito window without logging out. Tried that twice. I just updated to Home Assistant 2025.2.3 which seems to have a nest token refresh related fix and wanted to wait a few hours before trying to get a new cookie in case this fixes my issue, but perhaps they are unrelated? To me it seems like the issue is related to the token not being refreshed automatically and the reload is what is triggering the refresh.

[GSzabados]

I just updated to Home Assistant 2025.2.3 which seems to have a nest token refresh related fix

Completely unrelated, that is a completely different API (Google SDM)

To me it seems like the issue is related to the token not being refreshed automatically and the reload is what is triggering the refresh.

By any chance, are you using the token and cookie the same time on multiple HA instances? If you do so, would you mind to generate a separate token and cookie for each HA where you are using this integration? And could you please make sure that you are running the latest version of the integration?

[51av0sh]

Thanks @GSzabados. I do have another HA instance but I don't have this integration added to that one.

1. I deleted the devices (deleted the integration entry, not the HACS component)
2. Rebooted
3. Confirmed I'm on the latest (released 2 days ago it seems)
4. Generated a new token and cookie from incognito
5. Added the integration back
6. Closed the incognito window (didn't logout)

Monitoring now. If I make it past the 2 hour mark without an error then I should be good. I'll report back.

[51av0sh]

No luck. Same behavior. Errored out in 2 hours and reloading the integration fixed it again. Besides the loggedout error I also get this:

2025-02-15 11:59:30.962 ERROR (MainThread) [homeassistant.components.websocket_api.http.connection] [140442396701552] Unexpected exception Traceback (most recent call last): File "/usr/src/homeassistant/homeassistant/components/websocket_api/commands.py", line 245, in handle_call_service response = await hass.services.async_call( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ...<7 lines>... ) ^ File "/usr/src/homeassistant/homeassistant/core.py", line 2794, in async_call response_data = await coro ^^^^^^^^^^ File "/usr/src/homeassistant/homeassistant/core.py", line 2837, in _execute_service return await target(service_call) ^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 1007, in entity_service_call single_response = await _handle_entity_call( ^^^^^^^^^^^^^^^^^^^^^^^^^^ hass, entity, func, data, call.context ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ) ^ File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 1079, in _handle_entity_call result = await task ^^^^^^^^^^ File "/config/custom_components/nest_protect/switch.py", line 141, in async_turn_off result = await self.client.update_objects( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ...<4 lines>... ) ^ File "/config/custom_components/nest_protect/pynest/client.py", line 358, in update_objects raise NotAuthenticatedException(await response.text())

My command line sensor is monitoring for both errors to reload the integration since most of the time I get USER_LOGGED_OUT and sometimes I get the NotAuthenticatedException but not as often. I use both as a trigger to reload the integration.

[51av0sh]

One additional piece of info in case that is useful, I used to have an original Nest account from before Google bought them and I eventually migrated my account a few years ago to use Google SSO.

[GSzabados]

File "/config/custom_components/nest_protect/switch.py", line 141, in async_turn_off result = await self.client.update_objects

What are you trying to turn off? Where is the service call coming from? And what is the following error after this? I am asking, because after that exception, the integration should have either a 1 minute or 5 minutes pause, and should try to authenticate again.

[51av0sh]

Sometimes the integration silently fails without throwing a USER_LOGGED_OUT error. To test if the integration is still up and working I sometimes will just toggle one of the switch entities (from the list of entities, not a manual service call) which throws this NotAuthenticatedException error (any of the switch entities created by the integration) which in turn triggers my automation to reload the integration. There is no other protect error after that one. I have seen the message you are referring to before (the one that indicates the 5 min pause) but for some reason I no longer see it after I added the auto reload automation. I have just enabled debug logging so I'll see if there is anything new that I can share from the logs. I also turned off my automation in case there is more useful info I can get

[GSzabados]

Ok, I see. I think there might be a bug with the re-authentication there, and that's why reloading the integration works, because it does the reauthentication correctly.

Meanwhile could you try this?

change in the client.py the following to 600 at line 278:

    timeout = 3600 * 24

Otherwise, do you have any kind of random (dis)connection issues? What kind of internet are you using? Mobile? Starlink?

[51av0sh]

Gotcha. Well, strangely my last reload was 4 hours ago after that error I posted and I have not had a timeout since (even after toggling the switch entities randomly). I'll keep monitoring and change the timeout as you suggested if the issue comes back.

No other connection/disconnection issues. I'm on a wired (non-fiber) connection and pretty stable.

Looking at the logs I see the token is being refreshed hourly now with no issues (so far)

2025-02-15 15:03:48.713 DEBUG (MainThread) [custom_components.nest_protect] Subscriber: retrieving new Google access token
...
2025-02-15 16:04:25.874 DEBUG (MainThread) [custom_components.nest_protect] Subscriber: retrieving new Google access token

[GSzabados]

@51av0sh, do you have any further update?

I have looked at both yours and @geertmeersman's logs, all the USER_LOGGED_OUT seems to be due to the cookie is invalidated (due to the user has logged out or was invalidated in the browser). Those should raise an issue in Home Assistant, that you need to re-authentice the integration. I did not look there in details, that it does raise the issue or not, but should. If not, then that is a bug. The odd thing, is that the integration shows that 5 minutes pause error message. That exception should be captured correctly, but your observation was right, it should not try to connect again, as it should raise the issue for re-authentication.

[51av0sh]

Hey @GSzabados I'm not getting any more USER_LOGGED_OUT errors since I readded the token on the latest Nest Protect and Home Assistant builds. The only issue I've seen in the past 2 days is the custom_components.nest_protect.pynest.exceptions.NotAuthenticatedException error twice but only after I toggled one of the switch entities just to test that the integration is still working. The last time that happened was 26 hours ago but it has not happened since.

[51av0sh]

Seems it just happened again

2025-02-17 13:21:07.642 ERROR (MainThread) [homeassistant.components.websocket_api.http.connection] [140344294035312] Unexpected exception Traceback (most recent call last): File "/usr/src/homeassistant/homeassistant/components/websocket_api/commands.py", line 245, in handle_call_service response = await hass.services.async_call( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ...<7 lines>... ) ^ File "/usr/src/homeassistant/homeassistant/core.py", line 2794, in async_call response_data = await coro ^^^^^^^^^^ File "/usr/src/homeassistant/homeassistant/core.py", line 2837, in _execute_service return await target(service_call) ^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 1007, in entity_service_call single_response = await _handle_entity_call( ^^^^^^^^^^^^^^^^^^^^^^^^^^ hass, entity, func, data, call.context ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ) ^ File "/usr/src/homeassistant/homeassistant/helpers/service.py", line 1079, in _handle_entity_call result = await task ^^^^^^^^^^ File "/config/custom_components/nest_protect/switch.py", line 141, in async_turn_off result = await self.client.update_objects( ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ ...<4 lines>... ) ^ File "/config/custom_components/nest_protect/pynest/client.py", line 358, in update_objects raise NotAuthenticatedException(await response.text()) custom_components.nest_protect.pynest.exceptions.NotAuthenticatedException

However I no longer see USER_LOGGED_OUT in my logs at all and only see this error above if I toggle one of the switch entities (lovelace shows "Failed to perform the action switch/turn_off. unknown error" but it's not happening often or consistently like before (I used to get USER_LOGGED_OUT every 1 to 2 hours consistently).

[GSzabados]

I'm not getting any more USER_LOGGED_OUT errors since I readded the token

OK, I am happy to hear that. then it should be solved. For the NotAuthenticated could you try to change the timeout?

[51av0sh]

Sure thing. Just lowered it from 3600 * 24 to 600 * 24. I've also re-enabled debug logging. I'll keep you updated.

[GSzabados]

Just lowered it from 3600 * 24 to 600 * 24.

Just change it to 600 without the multiplication.

File "/config/custom_components/nest_protect/pynest/client.py", line 358, in update_objects raise NotAuthenticatedException(await response.text()) custom_components.nest_protect.pynest.exceptions.NotAuthenticatedException

This should be dealt with in the client.py to initiate an authentication for the new token, but the weird is that it checks already if the session expired. Might be some issue there.

[51av0sh]

Got it. Went back and changed it to 600 flat without * 24

[51av0sh]

@GSzabados Looks like that solved my problem