Pangolin + HA + Authentik

[mwantia]

Describe the bug
Login via the Home Assistant Companion App for Android is not possible when using the hass-oidc-auth integration.
OIDC authentication itself works correctly in all other scenarios, including desktop and mobile browsers.

The app correctly redirects to the external browser for authentication (tested Edge and Chrome).
Authentication itself succeeds, including the additional device verification step using the 6-digit code. After completing verification, the app gets stuck indefinitely on:

"You're about to give Home Assistant Companion app for Android access to your Home Assistant instance"
"Please wait"

The process never continues and the login does not complete.

No related errors are visible in:

• Home Assistant logs
• Authentik

To Reproduce
Steps to reproduce the behavior:

1. Configure Home Assistant to use hass-oidc-auth

2. Open the Home Assistant Companion App for Android

3. Start the login flow

4. Authenticate via the external browser using OIDC

5. Complete the additional device verification using the 6-digit code

6. Return to the app

7. Observe that the app remains stuck at:

   • "You're about to give Home Assistant Companion app for Android access to your Home Assistant instance"
   • "Please wait"

Expected behavior
After successful OIDC authentication and device verification, the Home Assistant Companion App should complete the OAuth flow and log the user into the instance.

Screenshots

Version

• Home Assistant Core version: 2026.5.4
• Home Assistant install method: Home Assistant OS
• Integration version: v1.1.0
• Browser (for authentication flow): mobile browser on Android

Additional context

• The issue only appears in the Android Companion App.
• Direct browser-based login works correctly on both desktop and mobile browsers.
• The external authentication provider in use is Authentik version 2025.12.3.
• The app successfully opens the browser and redirects correctly.
• The problem appears after the OAuth/OIDC flow completes and control returns to the app.

[christiaangoossens]

Did you try this with a mobile browser on the same device or using a different device?

Does it complete successfully if you use a different device/computer to login and input the code while keeping your phone on the code screen the entire time?

Edit: the screenshot and the "The app correctly redirects to the external browser for authentication (tested Edge and Chrome)." lines indicate that an external browser somehow opened from the app. The app itself should not do that and the code should only show within the app itself. All other steps are completed on a different device while the app remains open.

[mwantia]

There has been a new update to this issue.

All previously mentioned failed attempty have been done with a proxy between the device and Home Assistant.
This never caused problems, aside from now with the device authorization Home Assistant uses to authenticate.

After adjusting some settings (literally just pointing the phone to use the internal IP instead of the proxy) and after some back and forth the login now works sucessfully.
I'd still love to figure out why it doesn't want to work with it, but I don't believe that is part of this issue.

Do you happen to test this OIDC authentication with a proxy between Home Assistant?
In my case I decided to deploy a dedicated VPC running Authentik with Pangolin for remote access.

[christiaangoossens]

Do you happen to test this OIDC authentication with a proxy between Home Assistant?

Do you mean reverse proxy? If so, yes. So just Pangolin with no other settings for the host should work fine.

If you mean reverse proxy + auth (where you have to login before you even go to HA), then no, that is not a supported scenario. Pangolin + SSO within Pangolin enabled for that host is one of these unsupported setups.

My guess is that in your setup there are two different domains in play. As long as the HA app stays on the domain you entered into the input box, it should not open an external browser and it will work. When you go to an external domain for any reason and leave the app it breaks.

Having the SSO enabled within Pangolin for the host might cause exactly what you experience: the app starts on the inputted domain, then gets sent to Authentik within the app, breaking it out to the native browser and then you get stuck.

Edit: actually, this would have happened on any version before v1 as well, you would have just logged in to the 'web' version of HA after instead of the actual mobile app, which you might not have noticed.

[christiaangoossens]

Let me know if it works with Pangolin on the v1.1.1 release if you have SSO within Pangolin off for this domain.

[mwantia]

Yes, I am using Pangolin as a reverse proxy (Traefik under the hood) in combination with Authentik.

Pangolin itself has Platform SSO enabled, so all connections have to be authenticated before they even reach Home Assistant. If I disable authentication in Pangolin, everything works, aside from some minor hiccups during the initial setup.
However, I don't believe this to be a particularly secure solution, at least not compared to having SSO enforced directly by Pangolin.

For additional context, Pangolin, Authentik, and Home Assistant each use their own subdomain. That means your previous assumption was correct, and this is most likely the cause of the OIDC restrictions.

So, to keep this discussion short, I believe the OIDC authentication is working as intended and that the current issue simply stems from my setup.
At this point, the choice is either to leave the Home Assistant route open in Pangolin and bypass SSO on the reverse proxy, or to accept that external access via the mobile app is not possible.

[christiaangoossens]

Platform SSO in Pangolin (where Pangolin does the OIDC) is incompatible with doing OIDC in HA. This will never be implemented, not because I don't want to, but because its fundamentally not what the protocols are for.

If you use OIDC in an app, you should always disable any platform or proxy level auth to have the app handle it on its own.

Hopefully that helps!

Sidenote: it is possible to use Pangolin as the provider for HA, for that you create an OAuth app for HA in Pangolin and then configure it within HA. So, if you want to login using Pangolin credentials to HA that is possible. Just not applicable to your Authentik use case.