What is ha-oauth2-credentials-augment?

A guide for adding OAuth2 application credentials to an existing Home Assistant custom integration. OAuth2 is a standard way for an app to obtain permission to access another service on a user's behalf.

Use it to add provider authorization settings, convert the configuration flow, update the integration manifest and translations, and produce a conformance report.

It handles the integration changes and checks needed for this authentication flow, while asking for decisions about the provider and security details.

ha-oauth2-credentials-augment — Skill for Claude Code by nolte

Install

Getting it into your agent

One page per mod, every tool's command on it. A separate URL per tool would split the same page into five that compete with each other.

Any agent

npx skills add nolte/claude-home-assistant --skill ha-oauth2-credentials-augment

Clone the repo

git clone --depth 1 https://github.com/nolte/claude-home-assistant

Made for: Claude Code.

Or install claude-home-assistant, the plugin that ships this one along with the rest of its 45 skills, 11 agents.

Wrote this? Show the measurements

A badge with what this costs and how it scanned, read live from this page, so it follows the numbers instead of freezing them. Markdown for a README, HTML for a documentation site or a project page.

README.md

[![agentmods](https://agentmods.dev/badge/skills/nolte/claude-home-assistant/ha-oauth2-credentials-augment/github.svg)](https://agentmods.dev/skills/nolte/claude-home-assistant/ha-oauth2-credentials-augment)

Your own site

<a href="https://agentmods.dev/skills/nolte/claude-home-assistant/ha-oauth2-credentials-augment"><img src="https://agentmods.dev/badge/skills/nolte/claude-home-assistant/ha-oauth2-credentials-augment/github.svg" alt="Measured on agentmods" height="20"></a>

Or the 80×15 button, for a site that already has a row of RSS and ATOM ones. Only the verdict fits; the numbers stay here.

Your own site · 80×15

<a href="https://agentmods.dev/skills/nolte/claude-home-assistant/ha-oauth2-credentials-augment"><img src="https://agentmods.dev/badge/skills/nolte/claude-home-assistant/ha-oauth2-credentials-augment.svg" alt="Reviewed on agentmods" width="80" height="20"></a>

Per session 181 Skills are progressive disclosure: only the name and description are preloaded; the body loads when the skill is used.

When invoked 2,064 The whole file, excluding the scripts and references it only reads on demand.

Security scan A 0 findings. A grade says what 26 rules found in the file — not that it is safe.

Origin original No closer match found in the catalogue.

Token cost

What it costs to keep this loaded

Counted locally with the o200k_base tokenizer, which is exact for GPT models; Claude uses its own tokenizer and its counts differ. Treat this as one consistent yardstick across the catalogue rather than a bill. Prices are per million input tokens.

Model	Per session	Once invoked
Fable 5.1	$0.00181	$0.02064
Opus 5	$0.00090	$0.01032
Sonnet 5	$0.00036	$0.00413
Haiku 4.5	$0.00018	$0.00206

Measured 12d ago against content hash fc7859b8afd0, method: parsed. Prices are Anthropic first-party input rates as of 2026-09-12, from the pricing page.

Security

Grade A, and why

ha-oauth2-credentials-augment scanned grade A with 0 findings against 26 rules in 11 categories — prompt injection, anti-refusal, data exfiltration, privilege escalation, supply chain, agent snooping, system-prompt leakage, SSRF and excessive agency — measured 12d ago.

A static scan of the body, not an audit. Every finding is printed with the line that produced it so you can judge whether it matters here. A mod is markdown that instructs an agent; that is exactly why what it instructs is worth reading.

Nothing flagged

None of the 26 patterns this scan looks for appear in this file: no shell pipes, no recursive deletes, no credential paths, no hidden text, no instruction-override or anti-refusal phrasing, no agent-config snooping. That is not a guarantee, it is the absence of the things that are checkable.

skills/ha-oauth2-credentials-augment/SKILL.md · 109 lines

How it starts

The opening of the file, as written. The whole thing — 109 lines — stays where its author put it; the contents beside it link to each section on GitHub.

HA OAuth2 Credentials Augment

Spec: spec/claude/ha-oauth2-credentials-augment/en.md (EN canonical) / spec/claude/ha-oauth2-credentials-augment/de.md (DE translation).

Why this is a skill, not an agent

Human-visible augmentation surface — the user names the OAuth2 provider endpoints and reads back application_credentials.py, the OAuth2 config flow, and the conformance report; a skill keeps this on the visible command surface, like the sibling augment skills (ha-config-flow-augment, ha-coordinator-add, ha-repairs-add).
Mid-flow interactivity — the OAuth2-vs-non-OAuth2 check, the PKCE decision, and the unique_id source are per-run dialogues the user approves before generation.
Bounded, inline generation — one platform module plus the config-flow handler, the manifest edit, and the strings fit inline; no isolated agent context is needed.
Counter-dimension considered: the draft→validate loop could be an agent, but the provider-endpoint capture and the OAuth2-fit advice belong in the user's working context; skill wins.

When this skill activates

Use this skill to add the OAuth2 / Application Credentials flow to an existing integration whose provider requires OAuth2 — the user enters their own client id and secret via the Application Credentials UI.

When NOT to activate

a generic user/password or API-key config flow → ha-config-flow-augment / ha/config-flow-patterns
greenfield integration scaffolding → ha-integration-scaffold
coordinator wiring → ha-coordinator-add
deploying/importing into a running HA instance → out of scope

Hard rules

One flow, one run. Augment the OAuth2 application-credentials path; do not also rebuild a generic config flow.
Read spec/ha/application-credentials/en.md first. Do not generate from memory.
Manifest prerequisites. Add application_credentials to manifest.json:dependencies and ensure config_flow: true (see spec/ha/integration-manifest/en.md).
Authorization server contract. application_credentials.py implements async def async_get_authorization_server(hass) -> AuthorizationServer, importing AuthorizationServer from homeassistant.components.application_credentials; authorize_url and token_url are required and SHOULD be HTTPS, never hard-coded plaintext HTTP (see spec/ha/security-hardening/en.md). Add async_get_auth_implementation (optionally LocalOAuth2ImplementationWithPkce for PKCE) only when custom token handling is needed.
OAuth2 config-flow handler. Define the flow as a config_entry_oauth2_flow.AbstractOAuth2FlowHandler subclass with domain = DOMAIN and a logger property; use async_oauth_create_entry(self, data) and set unique_id (async_set_unique_id + _abort_if_unique_id_configured on first creation). Do not duplicate the generic mechanics from ha/config-flow-patterns.
HA owns the refresh. Run token refresh through the config_entry_oauth2_flow.OAuth2Session helpers — never refresh tokens manually. On setup, make a refresh call and raise ConfigEntryAuthFailed on auth failure so HA starts reauth.
Reauth path. Implement async_step_reauth / async_step_reauth_confirm; in the reauth case (self.source == SOURCE_REAUTH) call self._abort_if_unique_id_mismatch() and finish with async_update_reload_and_abort(self._get_reauth_entry(), data_updates=data).
No YAML credentials. Never accept OAuth2 client credentials via configuration.yaml.
Translate the dialog. Define the credentials dialog under the application_credentials key in strings.json (see spec/ha/translations/en.md); optional placeholders come from async_get_description_placeholders.
Name per spec/ha/naming-conventions/en.md and verify HA internals against the official docs (see spec/ha/upstream-docs-verification/en.md).

Read the full file on GitHub · 109 lines

Changes

What this file has done since we first saw it

Hashed on every crawl. A supply-chain change to an agent config is a question of when, not whether, so the history is kept rather than the latest state alone.

12d ago First seen · 109 lines · 181 tokens per session scan A fc7859b8afd0

Subscribe to this mod's changes

ha-oauth2-credentials-augment is a skill published in the GitHub repository nolte/claude-home-assistant (1 stars, last pushed 1mo ago), licensed MIT. It adds 181 tokens to every session and 2,064 once invoked, about $0.0009 per session on Opus 5. A static security scan graded it A with 0 findings. No closer match exists in the catalogue, so it is treated as the original; first seen 2026-08-31.

Backend and APIs Claude Code Security agents anthropic automation blueprints claude custom-integration home-assistant oauth2

authentication-patterns

OAuth 2.0, JWT, SSO, MFA, NextAuth/Clerk/Supabase Auth implementation patterns.

travisjneuman/.claude · 28 tokens

email-systems

Transactional email (Resend, SendGrid, SES), templates (React Email, MJML), deliverability (SPF/DKIM/DMARC), and inboxing best practices. Use when building email infrastructure, designing templates, or troubleshooting deliverability.

travisjneuman/.claude · 55 tokens

event-driven-architecture

Kafka, RabbitMQ, SQS/SNS, event sourcing, CQRS, saga patterns, dead letter queues, and idempotency. Use when designing asynchronous systems, implementing message-driven workflows, or building event streaming pipelines.

travisjneuman/.claude · 50 tokens

graphql-expert

GraphQL API design and implementation. Use when building GraphQL APIs, designing schemas, implementing resolvers, or optimizing GraphQL performance.

travisjneuman/.claude · 31 tokens

api-design

REST and GraphQL API design best practices including OpenAPI specs. Use when designing APIs, documenting endpoints, or reviewing API architecture.

travisjneuman/.claude · 29 tokens

generic-fullstack-feature-developer

Guide feature development for full-stack applications with architecture focus. Covers Next.js App Router patterns, NestJS backend services, database models, data workflows, and seamless integration. Use when adding new features, refactoring existing code, or planning major changes.

travisjneuman/.claude · 56 tokens