← Directory

HA Login Approval

HA Login Approval is a self-hosted, truly passwordless OpenID Connect (OIDC) identity provider that lets you approve or reject sign-ins from a Home Assistant…

  • Security
HA Login Approval is a self-hosted, truly passwordless OpenID Connect (OIDC) identity provider that lets you approve or reject sign-ins from a Home Assistant push notification instead of typing a password. It works with ZITADEL, Keycloak, Authentik, or any standard OIDC-compatible service, and adds one-time recovery codes, automatic IP blocking after three failed attempts, optional self-hosted GeoIP enrichment, and an admin panel for login history and account management — a good fit for homelab users who want passwordless login across their apps.

Platform availability

Available on 1 of 9 platforms

  • Unraid
  • TrueNAS (not listed)
  • Umbrel (not listed)
  • ZimaOS (not listed)
  • Proxmox (not listed)
  • Helm (not listed)
  • Mac (not listed)
  • Windows (not listed)
  • Linux (not listed)

Health score?A 0-100 score computed nightly from four factors: maintained (40%: recent commits and steady activity), popular (25%: GitHub stars, log scale), easy to install (20%: platforms, install notes, setup guides, Docker image) and light to run (15%: minimum RAM, ARM support). When the source code has been checked, a fifth factor, security check (20%: automated scan for committed secrets, unsafe desktop-app settings, known-vulnerable dependencies and project hygiene; any serious finding caps it at 20), is added. Factors without data are left out and the rest are rescaled.

44/100 Fair

Maintained
84last commit 2 days ago
Popular
00 GitHub stars
Easy to install
201 install platform, Docker image
Light to run
No data

Based on 3 of 4 factors.

Availability: platform listings confirmed today

GitHub stars
0
Open issues
1
Last commit
2026-10-11
Latest release
v2.8.0
License
MIT
Activity
declining

Checked today - source: GitHub (Nebur692/ha-login-approval)

Resources & Compatibility

Requirements not published yet.

Checked today - source: Docker Hub image tags and published docs

First-install notes

  • Reverse proxy: set Trusted proxies If you run this behind a reverse proxy (Nginx Proxy Manager, Traefik, Caddy), set "Trusted proxies" to your proxy's address. Until you do, every notification and audit entry shows the proxy instead of the visitor, and GeoIP location lookups will be meaningless. source

Fetched today - each note links to its source

Alternatives

No alternatives collected yet.

Common questions

What do I need to configure if I run it behind Nginx Proxy Manager, Traefik, or Caddy?

Set Trusted proxies to your reverse proxy's address. Otherwise the service uses the address it is connected from, so notifications and audit entries can show the proxy instead of the client.

Can I use it with Keycloak or Authentik instead of ZITADEL?

It acts as a generic OIDC identity provider. It is confirmed end-to-end against ZITADEL and should work with other standards-compliant relying parties such as Keycloak and Authentik.

Where are approved accounts and devices stored?

They are kept in a self-contained SQLite file that maps emails to assigned devices. The app does not call an identity provider's admin API to determine who is who.

What can I do if a push notification never arrives?

Use one-time recovery codes as an emergency fallback. They are shown once when generated and stored only as irreversible hashes.

Does a rejected or failed sign-in block the account?

An explicit reject or wrong recovery code counts toward a 3-strike block scoped to that account and IP. The block can be manually removed from the admin panel, and a silent timeout does not count.

Answers sourced from github.com

Community

Collected today - public community threads