Keep your remote access secure

For every connection

• Use a unique, strong password for this service and store it in a password manager.
• Keep Home Assistant, your router and any optional home proxy updated. Back up Home Assistant before changing its configuration.
• Keep account passwords, connection tokens, automation traces and backups private. Remove them from screenshots before asking for help.
• Check the last-update time before relying on a reading. Past contact does not prove the home is currently online.
• Make sure you can still open Home Assistant from your home network if remote access stops working.

Full Proxy

• Keep Home Assistant authentication enabled. Use unique passwords, enable its multi-factor authentication and give administrator access only where needed. Manage Home Assistant account security.
• Know what is protected. Your browser connects securely to our service. By default, the connection from our service to your Home Assistant is not encrypted. Someone who intercepts it could read the traffic, including sign-in details. HTTPS with a valid, trusted home certificate can protect this connection. Our service can still read and process the traffic even when both connections use HTTPS.
• Only allow our server to connect. Use the server IP addresses shown in your setup to restrict the router or firewall rule. This limits who can connect; it does not encrypt traffic. Do not open your router’s administration page to the internet or use its DMZ setting to expose Home Assistant.
• Copy the trusted-proxy settings from your account. Add only the specified addresses to Home Assistant. Do not allow every IP address. Review proxy settings.
• Keep private files out of /local/. Home Assistant serves files in its www directory without login. Do not put snapshots, tokens or backups there. Read its file-hosting warning.

Relay — a simple dashboard

Home Assistant starts a secure connection to our service, sends your selected updates and collects control requests. You don’t need to open a port on your router, and Relay works behind CGNAT when Home Assistant can reach our service. We receive the selected data and handle dashboard control requests.

Sign in with your account on this site or a shared dashboard login from the owner. These are separate from your Home Assistant account, so Home Assistant’s multi-factor authentication does not protect them. Use a strong, unique password for each account.

• Choose only the entities you need. Readings can reveal when you’re home and your daily routines.
• Start with a reading and a lamp you can observe locally. Check what a script does before adding its Run button to your dashboard.
• Enable lock or cover controls only for the specific entities you intend to operate. They are display only until permitted in setup.
• Back up configuration.yaml. Add the generated commands under one rest_command: section, check the YAML and reload RESTful commands before using the automation.
• Use one enabled automation or optional connector per Relay plan. Keep the generated automation private because it contains the connection token.

If someone else gets your token, select Replace connection token in Relay setup, then copy the new automation into Home Assistant. Disable connection token stops updates and control requests that use that token. An action Home Assistant has already collected may still run.

Token and selection-change instructions · Data handling

Which password or token do I use?

Never paste passwords or connection tokens into a support ticket. Remove them from screenshots and automation traces too.

Your service password

Signs you in here to manage plans, setup and Relay. Keep it different from the Home Assistant password.

Your Home Assistant login

Opens the full interface through Proxy. Proxy setup does not need a Home Assistant access token.

Your Relay connection token

Connects Home Assistant to one Relay dashboard so it can send updates and collect control requests. It is included in the generated automation. Keep that code private, just like a password.

Your Proxy IP-update token

Lets the IP-update automation report your home’s current internet address for one Proxy connection. It does not sign you in to Home Assistant.

After a network or device change

• For Proxy, confirm the forwarding destination, allowed sources and trusted-proxy addresses still match setup. Check your home certificate if you chose HTTPS.
• For Relay, confirm the automation is enabled and fresh updates arrive.
• Test from outside your home, including the Companion app if you use it.

If your internet provider changes your home’s IP address, Proxy needs a way to find the new one. Use an existing DDNS hostname or the IP-update automation in your setup. A fixed address needs neither. These options do not fix CGNAT or a closed port.

Keep a recovery path

Keep current Home Assistant backups and confirm you can access its local interface. Remote access does not back up your installation or replace local administration.

If you lose a phone or expose a password or token

1. Use your local connection to review Home Assistant access if its credentials were exposed. Follow the official account-security instructions.
2. Replace or disable an exposed connection token in Relay or Proxy settings. After replacing it, save the new automation in Home Assistant.
3. If you cannot sign in to this service, open password recovery. Do not post passwords, tokens or complete automation traces.
4. Review router restrictions and test the connection again once the issue is resolved.

Review my connection settings · Open a support ticket