You can secure your account by following official instructions from Home Assistant to enable multi-factor authentication. These steps guide you through setting up a second verification challenge alongside your password.
What it does
Multi-factor authentication requires you to solve a second challenge after providing your password. Home Assistant supports Time-based One-Time Password and Notify MFA modules.
Before you start
You will need an authenticator app on your phone, such as Google Authenticator or Authy, which are available for iOS or Android. You must also be able to edit your configuration.yaml file and restart Home Assistant.
Steps
Step 1: Enable TOTP in your configuration.yaml file by adding auth_mfa_modules with type totp, or leave it undefined to autoload the Authenticator app module.
Step 2: Restart Home Assistant and go to your User profile > Security.
Step 3: In the Multi-factor authentication modules section, select Enable to generate a new secret key.
Step 4: Open your phone app and enter the key, either by scanning the QR code or typing in the key below the QR code manually.
Step 5: Enter the six-digit code generated by your app into Home Assistant under the QR code where it asks for a Code.
What Home Assistant says
Home Assistant notes that you should treat the secret key like a password and never expose it to others. The system also relies on your Home Assistant clock being accurate.
What to do
- Enable TOTP in your configuration.yaml file, restart Home Assistant, go to User profile > Security, select Enable, and scan the QR code with your authenticator app.
Key facts and where they come from
- MFA provides a second level of defense requiring something you know and something you have.
MFA provides a second level of defense by requiring: something you know, like your username and password, and something you have, like a one-time password sent to your phone.
- Home Assistant recommends either Google Authenticator or Authy for iOS or Android.
We recommend either Google Authenticator or Authy. Both are available for iOS or Android.
