Yes Weheat made the API more strict:
- RedirectURL is now tied to the ClientID. So I’m not sure if this integration still uses the ClientID of HomeAssistant, but that is now tied to Link to OAuth2 Authorize Callback – My Home Assistant
- The integration now require PKCE for the OAuth integration.
I cannot help you with Homey, but I’m the maintainer of the HomeAssistant version. See the PR here: Use PKCE for Weheat OAuth2 authorization by barryvdh · Pull Request #181881 · home-assistant/core · GitHub
And yes, it’s annoying that they keep changing the API without notifying.