# \[Unsupported\] Homey v2 REST API

**URL:** <https://community.homey.app/t/unsupported-homey-v2-rest-api/7268>\
**Category:** Developers\
**Created:** [January 18, 2019, 3:07pm UTC](https://community.homey.app/t/unsupported-homey-v2-rest-api/7268 "2019-01-18T15:07:04Z")\
**Posts on this page:** 1\
**Showing post:** 47

<div class="post-metadata">

**Author:** ![Lammy](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/lammy/32/11436_2.png) [@Lammy](https://community.homey.app/u/Lammy)\
**Post date:** [May 28, 2019, 6:25am UTC](https://community.homey.app/t/unsupported-homey-v2-rest-api/7268/47 "2019-05-28T06:25:08Z")

</div>

Here’s how to have your application login to homey with just your e-mail address and password (once) and obtain a refresh token for subsequent access.  
Notice, the refresh token will expire, either by expiration or revocation.  
There are quite a few more things to discover, but this will get you going.

In the following steps, I didn’t register a new application (probably possible, but I didn’t look into that yet), I just borrowed the client\_id and client\_secret from [developer.athom.com](http://developer.athom.com) (client\_id=598d85a330e1bb0c0d75b8eb and client\_secret=ba93fc861b204732607169fb29c2708f1da7e17f). Other combinations for client\_id and client\_secret will also work (for example homey.ink), as long as the redirect\_uri matches.

Step 1, get a JWT with your credentials.  
HTTPS-POST your e-mail address and password, form-url-encoded, to [accounts.athom.com/login](http://accounts.athom.com/login).  
No client\_\* needed at this time.  
The JSON reply is the JWT as {“token”: “`jwt`”}

Step 2, obtain a delegation code.  
HTTPS-GET [accounts.athom.com//authorise?client\_id=xxx&redirect\_uri=](http://accounts.athom.com//authorise?client_id=xxx&redirect_uri=)`uri`&response\_type=code&user\_token=`JWT from previous step`  
Since I used the client\_id from [developer.athom.com](http://developer.athom.com), the `uri` in this case is the aforementioned. The redirect\_uri is important and will be checked (as it should be)  
Be aware, the HTTP result will be a 302 (redirect).  
The location-header contains a query parameter ‘code’. It’s value is the delegation code. The header looks like: “location: https://`redirect_uri`?code=89bc40ceXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX29”.

Step 3, get an access token  
HTTPS-POST [api.athom.com/oauth2/token](http://api.athom.com/oauth2/token), form-url-encoded  
Body: client\_id=XXX&client\_secret=YYY&grant\_type=authorization\_code&code=`Delegation code from previous step`  
The JSON result looks like this in readable format:  
{  
“access\_token”: “51163d8xxxxxxxxxxxxxxxx8282579f8fe77ee”,  
“expires\_in”: 3660,  
“refresh\_token”: “f7d635axxxxxxxxxxxxxxxx1c2a258f4e33d15b”,  
“token\_type”: “bearer”  
}  
Use the access\_token for the next step, but also keep the refresh\_token. You will need the refresh\_token in the future to obtain a new bearer code.

Step 4, obtain a JWT to login to your homey  
HTTPS-POST [api.athom.com//delegation/token?audience=homey](http://api.athom.com//delegation/token?audience=homey)  
Add an http-header: Authorization: Bearer `access_token from previous step or step 6`  
The JSON result contains just the JWT.

Step 5, login to homey  
HTTPS-POST `uri`/api/manager/users/login  
Body: {"token”:”`JWT from step 4`”}  
The reply is the desperately sought bearer token in JSON format.  
`uri` can be a number of things:

- The fastest option is homey’s local IP address.
- The second is a local qualified DNS name.
- Another option is: [w-x-y-z.homey.homeylocal.com](http://w-x-y-z.homey.homeylocal.com) (w-z = the local IP address bytes).
- More options exist, all through the cloud and pretty much equally slow.

The bearer code will expire after 24 hours. To obtain a new one without user credentials, see step 6.

Step 6, refresh the bearer token  
The bearer token expires every 24 hours and with good reason.  
If you saved the refresh\_token from step 3, you can obtain a new access\_token and hence a new bearer token. Note: this will not go on indefinitely. At some point you will have to login again.  
HTTPS-POST [api.athom.com/delegation/token?audience=homey](http://api.athom.com/delegation/token?audience=homey), form-url-encoded.  
Body: client\_id=XXX&client\_secret=YYY&grant\_type=refresh\_token&refresh\_token=\<refresh\_token\>  
The response is similar to the response in step 3. Use the access\_token to repeat steps 4 and 5. Keep the refresh\_token for the next refresh (The refresh\_token may change).

With the access\_token received in step 3 or 6 you can find useful information like cloud id and homey’s ip address:  
HTTPS\_GET [api.athom.com/user/me](http://api.athom.com/user/me)  
Add header: Authorization: Bearer \<access\_token from step 3 or 6\>

---

_[View the full topic](https://community.homey.app/t/unsupported-homey-v2-rest-api/7268)._