Nest Protect integration for Home Assistant

Custom component for Home Assistant to interact with Nest Protect devices via an undocumented and unofficial Nest API. Unfortunately, Google SDM doesn't support Nest Protect devices and thus the core Nest integration won't work for Nest Protect.

This integration will add the most important sensors of your Nest Protect device (CO, heat and smoke) and the occupancy if your device is wired (to main power). In addition, it will expose several diagnostic and configuration entities. All sensor values will be updated real-time.

• Only Google Accounts are supported, there is no plan to support legacy Nest accounts
• When Nest Protect (wired) occupancy is triggered, it will stay 'on' for 10 minutes. (API limitation)
• Only cookie authentication is supported as Google removed the API key authentication method. This means that you need to login to the Nest website at least once to generate a cookie. This cookie will be used to authenticate with the Nest API. The cookie will be stored in the Home Assistant configuration folder and will be used for future requests. If you logout from your browser or change your password, you need to reautenticate and and replace the current issue_token and cookies.

You can install this integration via HACS or manually.

Add this repository (https://github.com/Jastroger/ha-nest-protect) as a custom repository in HACS with the category Integration. Then search for the Nest Protect integration and choose install, then reboot Home Assistant. Configure the Nest Protect integration either via the integrations page or press the blue button below.

Copy the custom_components/nest_protect to your custom_components folder and reboot Home Assistant. Configure the Nest Protect integration either via the integrations page or press the blue button below.

Primary path for Home Assistant OS / Supervised:

1. Install this integration.
2. Install the Nest Protect Auth Bridge add-on.
3. Add the Nest Protect integration in Home Assistant.
4. Start login in the integration flow.
5. Click the launch link to open the add-on Ingress page with one-time session parameters.
6. Complete Google/Nest sign-in in the visible browser embedded in the Auth Bridge add-on UI.
7. Return to Home Assistant and click Submit / Continue after login if needed.
8. Setup completes automatically once callback validation succeeds.

Alternative path for Home Assistant Container / Core:

1. Install this integration.
2. Start the Nest Protect Auth Bridge as a standalone Docker container with HA_BASE_URL set to your Home Assistant host URL.
3. Add the Nest Protect integration in Home Assistant.
4. Select Standalone Docker Auth Bridge (HA Container/Core) in the integration flow.
5. Enter the standalone Auth Bridge URL, usually http://192.168.178.xxx:8099.
6. Click the generated launch link from Home Assistant.
7. Complete Google/Nest sign-in in the visible browser embedded in the Auth Bridge UI.
8. Return to Home Assistant and click Submit / Continue after login if needed.
9. Setup completes automatically once callback validation succeeds.

The product goal is zero DevTools setup: normal users should not open browser developer tools, export HAR files, inspect Network requests, search for Cookie headers, or run JavaScript snippets.

Use standalone mode when you run Home Assistant Container or Core and cannot install Home Assistant add-ons.

Copy .env.example to .env, then set HA_BASE_URL to the URL that the Auth Bridge container can use to reach Home Assistant. Use the Home Assistant host IP, for example http://192.168.178.xxx:8123.

Do not use localhost for HA_BASE_URL unless you intentionally run with host networking. Inside a normal Docker container, localhost points to the Auth Bridge container itself, not Home Assistant.

HA_BASE_URL=http://192.168.178.xxx:8123
AUTH_BRIDGE_PORT=8099
docker compose -f docker-compose.example.yml --env-file .env up --build

Standalone Docker uses addons/nest-protect-auth-bridge/Dockerfile.standalone, based on python:3.13-slim-bookworm. This is intentional: Playwright Python packages do not install reliably on Alpine/musl Home Assistant base images. On Raspberry Pi 4, Docker should pull the arm64/aarch64 variant of the Debian-based Python image automatically. The Home Assistant add-on packaging can keep its separate Home Assistant base image Dockerfile.

Standalone mode uses the same browser capture UI as the add-on, but posts the callback directly to:

http://<ha-host>:8123/api/nest_protect/auth_bridge/{session_id}

It does not require the Home Assistant Add-on Store and does not use SUPERVISOR_TOKEN.

In the Home Assistant config flow, select Standalone Docker Auth Bridge, enter the Auth Bridge URL, usually http://192.168.178.xxx:8099, and click the generated launch link. Do not open the bridge manually without the launch link, because the bridge needs the one-time session_id and secret from Home Assistant.

Use these notes for release validation and troubleshooting.

1. Install this repository's add-on source as a local add-on (copy addons/nest-protect-auth-bridge into your Home Assistant local add-ons directory).
2. In Home Assistant, go to Settings → Add-ons, open Nest Protect Auth Bridge, then click Start.
3. Open the add-on through the Home Assistant sidebar (Ingress panel: Nest Protect Auth Bridge). The config-flow launch link should also open this Ingress page with one-time launch parameters.
4. Click Start Login and confirm noVNC shows a live Chromium window (Nest sign-in page rendered inside the embedded browser frame).
5. If something fails, check logs in both places:
   • Home Assistant add-on log panel (Settings → Add-ons → Nest Protect Auth Bridge → Log)
   • Runtime files inside the add-on container: /tmp/auth-bridge.log (Flask/Playwright/Chromium), /tmp/websockify.log, /tmp/x11vnc.log, /tmp/fluxbox.log
6. If the standalone Docker build tries to use ghcr.io/home-assistant/*-base, make sure docker-compose.example.yml builds Dockerfile.standalone. Standalone Docker must use the Debian-based Python image because Playwright does not work reliably on Alpine/musl.
7. If the add-on Docker build fails with externally-managed-environment, make sure the add-on Dockerfile installs Python requirements into /opt/venv and uses /opt/venv/bin/pip, not system pip3 install.
8. Known limitation: Home Assistant Ingress URL handling can vary by installation/frontend path. The config-flow launch link behavior must be tested on real HA OS/Supervised environments before release.
9. Manual wizard/DevTools flow remains fallback-only for troubleshooting and should not be the default user path.

The integration now has a callback endpoint for an add-on or companion app:

POST http://supervisor/core/api/nest_protect/auth_bridge/{session_id}

For standalone Docker mode, use the Home Assistant base URL instead:

POST http://<ha-host>:8123/api/nest_protect/auth_bridge/{session_id}

Payload:

{
  "secret": "one-time-session-secret",
  "issue_token": "https://accounts.google.com/o/oauth2/iframerpc?action=issueToken&...",
  "cookies": "SID=***; HSID=***; SSID=***; APISID=***; SAPISID=***"
}

The session_id and one-time secret are created by the Home Assistant config flow. Add-ons should call the Supervisor/Core API callback with the Supervisor token. Standalone Docker mode should call the Home Assistant callback URL directly and relies on the one-time secret for protection. The callback stores the result only when the secret matches. The config flow then validates the credentials and finishes setup.

Use this only if the Auth Bridge add-on / companion flow is unavailable. These values are specific to your Google account.

1. Open a Chrome/Edge browser tab in Incognito Mode.

2. Allow third-party cookies in your browser settings to prevent the Nest website from entering a redirect loop. Follow these steps:

   • In Chrome: Go to Settings, select Privacy and Security -> Third-party cookies. Enable "Allow third-party cookies."
   • In Edge: Go to Settings, select Cookies and site permissions -> Manage and delete cookies and site data. Disable "Block third-party cookies."

3. Open Developer Tools.

4. Click on Network tab. Make sure 'Preserve Log' is checked.

5. In the Filter box, enter issueToken

6. Go to home.nest.com, and click Sign in with Google. Log into your account.

7. One network call (beginning with iframerpc) will appear in the Dev Tools window. Click on it.

8. In the Headers tab, under General, copy the entire Request URL (beginning with https://accounts.google.com). This is your 'issue_token' in the configuration form.

9. In the Filter box, enter oauth2/iframe

10. Several network calls will appear in the Dev Tools window. Click on the last iframe call.

11. In the Headers tab, under Request Headers, copy the entire cookie (include the whole string which is several lines long and has many field/value pairs - do not include the cookie: name). This is your 'cookies' in the configuration form.

12. Do not log out of home.nest.com, as this will invalidate your credentials. Just close the browser tab.

Feel free to create an issue on GitHub if you find an issue or if you have a suggestion. It is always helpful to download the diagnostics information and to include debug logging.

The logger integration lets you define the level of logging activities in Home Assistant. Turning on debug mode will show more information about unsupported devices in your logbook.

logger:
  default: critical
  logs:
    custom_components.nest_protect: debug

Based on the research and implementation of homebridge-nest.