# \[Unsupported\] Homey v2 REST API

**URL:** <https://community.homey.app/t/unsupported-homey-v2-rest-api/7268>\
**Category:** Developers\
**Created:** [January 18, 2019, 3:07pm UTC](https://community.homey.app/t/unsupported-homey-v2-rest-api/7268 "2019-01-18T15:07:04Z")\
**Posts on this page:** 1\
**Showing post:** 30

<div class="post-metadata">

**Author:** ![Niels](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/niels/32/89_2.png) [@Niels](https://community.homey.app/u/Niels)\
**Post date:** [May 19, 2019, 12:03pm UTC](https://community.homey.app/t/unsupported-homey-v2-rest-api/7268/30 "2019-05-19T12:03:22Z")

</div>

I have no idea how to authenticate local, Using the homey.ink procedure i was able to authenticate on cloud and use all the API’s. As i had trouble finding the needed info here, here is my contribution. Hope this is helpful to someone.

**Getting a unlimited key**  
First step is to get a token that is reusable (longer then 24 Hours), because the API bearer token is only usable for 24 hours and we don’t want to change our code every 24 hours. homey.ink is our solution as it generates a key without an expiration date.

Here we go:

 ![HomeyApi1](https://us1.discourse-cdn.com/flex025/uploads/athom/original/2X/6/64cf183eb12c8115d17cc5689a0a407988fcbbaa.png)

Step 1: Go to [https://homey.ink](https://homey.ink) using google chrome.

Step 2: Right click on the page and select inspect(inspecteren) or use Ctrl + Shift + I

Step 3: Select the Network Tab (this will show the network traffic after the authentication is done)

Step 4: Use the “Log In” button and follow the authentication steps.

Step 5: Use the scrollbar if needed, (If you followed this step by step you’ll probably only see one item)

Step 6: select the item named “token, [api.athom.com/oauth2](http://api.athom.com/oauth2)”

Step 7: In the headers view scroll down to Form Data, and select the “view source” button.

Step 8: below the “View Source” button the needed key will be shown. Copy it . We’ll need it for the API authentication. it will look something like this:

client\_id=09ab2b247cdff0918abfd00d&client\_secret=l159fjann0173h2jllsppehg2vj4l28dhhakl3010&grant\_type=authorization\_code&code=09ab2b247cdff0918abfd00d47cdff0918a2b2414

P.S. This is just an example. your key will look a bit different.

now send the following  
POST [https://api.athom.com/oauth2/token](https://api.athom.com/oauth2/token)  
_Headers:_  
Content-Type: application/x-www-form-urlencoded  
_Body_  
client\_id=09ab2b247cdff0918abfd00d&client\_secret=l159fjann0173h2jllsppehg2vj4l28dhhakl3010&grant\_type=authorization\_code&code=09ab2b247cdff0918abfd00d47cdff0918a2b2414

The response will include a refresh token.

To build the “unlimited” key, use the first part of the key, like:

- client\_id=09ab2b247cdff0918abfd00d&client\_secret=l159fjann0173h2jllsppehg2vj4l28dhhakl3010&grant\_type=

- Add: _refresh\_token&refresh\_token=_

- and then add the refresh\_token (gotten from the authentication above)

The result will look like this:

_client\_id=09ab2b247cdff0918abfd00d&client\_secret=l159fjann0173h2jllsppehg2vj4l28dhhakl3010&grant\_type=refresh\_token&refresh\_token=09ab2b247cdff0918abfd00d47cdff0918a2b2414_

This key can be reused in your code to re authenticate yourself every 24 hours without the need to open your brouwer and the former steps.

**Getting the bearer token**  
With the key we got above we can now programmatically get a bearer token.  
There are a couple of steps needed to get it, the bearer token is valid for 24 Hours. after 24 Hours you will need to get a new bearer token.

**Step 1:**  
use the **KEY** you’ve got from **Getting a unlimited key** as body.

POST [https://api.athom.com/oauth2/token](https://api.athom.com/oauth2/token)  
_Headers:_  
Content-Type: application/x-www-form-urlencoded  
_Body_  
**KEY**

Result: will be a Json formatted output. we’ll need the “access\_token” value.

**Optional Step:**  
With this request you can get all kind of interesting data, i.e. cloud ID’s and users.  
Use the **ACCESS\_TOKEN** gotten in step 1.

GET [https://api.athom.com/user/me](https://api.athom.com/user/me)  
_Headers:_  
Authorization: **ACCESS\_TOKEN**

**Step 2:**  
Use the **ACCESS\_TOKEN** gotten in step 1.

POST [https://api.athom.com/delegation/token?audience=homey](https://api.athom.com/delegation/token?audience=homey)  
_Headers:_  
Authorization: **ACCESS\_TOKEN**

Result: A JWT formated token.

**Step 3:**  
Use the **JWT\_TOKEN** gotten in step 2.  
Use the **CLOUD\_ID** for your homey, this can also be found in the Optional Step.

POST https:// **CLOUD\_ID**.connect.athom.com/api/manager/users/login  
_Headers:_  
Content-Type: application/json  
_Body:_  
{“token”:“ **JWT\_TOKEN** ”}

Result: the bearer token that can be used in all API’s

**API Test Step**  
Use the **BEARER-TOKEN** gotten in step 3  
Use the **CLOUD\_ID** for your homey, this can also be found in the Optional Step.

GET https:// **CLOUD\_ID**.connect.athom.com/api/manager/devices/device/.  
_Headers:_  
Authorization: **BEARER-TOKEN**

---

_[View the full topic](https://community.homey.app/t/unsupported-homey-v2-rest-api/7268)._