Home Assistant long lived access token: setup and security guide

A Home Assistant long lived access token is an authentication credential that lets external applications, scripts, and automation platforms interact with your Home Assistant instance via its REST API or WebSocket API. Unlike short-lived tokens that expire with your browser session, long lived tokens persist until you explicitly revoke them.

Home Assistant reported surpassing 1 million active installations in late 2024. Unlike generic AI automation posts, this guide shows real CodeWords workflows — not just theory.

How do you create a long lived access token?

1. Open your Home Assistant instance (typically http://homeassistant.local:8123)
2. Click your profile icon in the bottom-left sidebar
3. Scroll to the bottom of the profile page
4. Under Long-Lived Access Tokens, click Create Token
5. Name the token descriptively (e.g., "CodeWords automation")
6. Copy the token immediately — Home Assistant only shows it once

What can you do with a Home Assistant API token?

The token unlocks the full REST API and WebSocket API: read entity states, call services (turn on lights, lock doors, set thermostats), pull history data, and fire custom events.

How should you secure a long lived access token?

• Store tokens in environment variables or a secrets manager
• Create separate tokens for each integration
• Name tokens clearly so you can audit them later
• Never commit tokens to Git repositories

On CodeWords, credentials are stored as encrypted secrets within your workspace — the token is referenced by name, never exposed in workflow code.

FAQs

Do Home Assistant long lived access tokens expire?
No. They persist until you manually revoke them from your profile page.

Can you create a token with limited permissions?
Not directly. Tokens inherit the full permissions of the user account. Create a dedicated non-admin user to limit scope.

Build smart home AI workflows on CodeWords →