# HA Login Approval

HA Login Approval is a self-hosted, truly passwordless OpenID Connect (OIDC) identity provider that lets you approve or reject sign-ins from a Home Assistant push notification instead of typing a password. It is open source and self-hosted, installable on Unraid.

Canonical page: https://ourlocalhost.com/app/6981/ha-login-approval

## Description

HA Login Approval is a self-hosted, truly passwordless OpenID Connect (OIDC) identity provider that lets you approve or reject sign-ins from a Home Assistant push notification instead of typing a password. It works with ZITADEL, Keycloak, Authentik, or any standard OIDC-compatible service, and adds one-time recovery codes, automatic IP blocking after three failed attempts, optional self-hosted GeoIP enrichment, and an admin panel for login history and account management — a good fit for homelab users who want passwordless login across their apps.

## Platform availability

Available on 1 of 9 platforms: Unraid.

## Health score

44/100 (Fair), based on 3 of 4 factors.
- Maintained: 84 (last commit 2 days ago)
- Popular: 0 (0 GitHub stars)
- Easy to install: 20 (1 install platform, Docker image)

## Links

- Unraid: https://ca.unraid.net/apps/ha-login-approval-0zfne440jzcshc?q=ha-login-approval
- GitHub: https://github.com/Nebur692/ha-login-approval

## Common questions

### What do I need to configure if I run it behind Nginx Proxy Manager, Traefik, or Caddy?

Set Trusted proxies to your reverse proxy's address. Otherwise the service uses the address it is connected from, so notifications and audit entries can show the proxy instead of the client.

### Can I use it with Keycloak or Authentik instead of ZITADEL?

It acts as a generic OIDC identity provider. It is confirmed end-to-end against ZITADEL and should work with other standards-compliant relying parties such as Keycloak and Authentik.

### Where are approved accounts and devices stored?

They are kept in a self-contained SQLite file that maps emails to assigned devices. The app does not call an identity provider's admin API to determine who is who.

### What can I do if a push notification never arrives?

Use one-time recovery codes as an emergency fallback. They are shown once when generated and stored only as irreversible hashes.

### Does a rejected or failed sign-in block the account?

An explicit reject or wrong recovery code counts toward a 3-strike block scoped to that account and IP. The block can be manually removed from the admin panel, and a silent timeout does not count.

---
Source: Our Local Host (https://ourlocalhost.com/app/6981/ha-login-approval), the self-hosted and open-source app directory.