Volkswagen Carnet API shutdown - Revision history

Louis: Fix two verbatim-quote integrity defects flagged by hostile re-audit (wcmqtt repo description framing; harepo capitalization via bracketed [a])

2026-05-30T22:28:03Z

Fix two verbatim-quote integrity defects flagged by hostile re-audit (wcmqtt repo description framing; harepo capitalization via bracketed [a])

← Older revision		Revision as of 22:28, 30 May 2026
Line 111:		Line 111:

	; Live data feed over MQTT for other apps		; Live data feed over MQTT for other apps
	: The companion ''WeConnect-mqtt'' library is ''"an MQTT Client that publishes data from Volkswagen WeConnect"'', republishing live vehicle data on MQTT topics any other home tool could subscribe to.<ref name="wcmqtt" /> The official apps expose no MQTT, REST or webhook interface; they are closed mobile clients.<ref name="vwallservices" />		: The companion ''WeConnect-mqtt'' library is described in its repository as an ''"MQTT Client that publishes data from Volkswagen WeConnect"'', republishing live vehicle data on MQTT topics any other home tool could subscribe to.<ref name="wcmqtt" /> The official apps expose no MQTT, REST or webhook interface; they are closed mobile clients.<ref name="vwallservices" />

	; Lock or unlock the car from a script or automation		; Lock or unlock the car from a script or automation
Line 123:		Line 123:

	; Free remote charge and climate control, no subscription		; Free remote charge and climate control, no subscription
	: The integration itself carried no licence fee or subscription tier on top of the owner's existing VW Connect account, though the README notes that ''"an active VW online subscription connected to your car is required"'' upstream.<ref name="harepo" /> Volkswagen UK's services page lists ''"Extend by 1 year (inc. VAT) £129"'' for We Connect Plus once the included two-year trial runs out, a price the ID.3 owners' forum confirms.<ref name="vwallservices" /><ref name="id3plus" />		: The integration itself carried no licence fee or subscription tier on top of the owner's existing VW Connect account, though the README notes that ''"[a]n active VW online subscription connected to your car is required"'' upstream.<ref name="harepo" /> Volkswagen UK's services page lists ''"Extend by 1 year (inc. VAT) £129"'' for We Connect Plus once the included two-year trial runs out, a price the ID.3 owners' forum confirms.<ref name="vwallservices" /><ref name="id3plus" />

	=== Volkswagen's response ===		=== Volkswagen's response ===

Louis: Expand HA-vs-VW-app capability detail under simplified table; replace developer jargon with plain English

2026-05-30T19:56:23Z

Expand HA-vs-VW-app capability detail under simplified table; replace developer jargon with plain English

Show changes

Louis: simplified the capability table to yes/no columns and tightened the prose throughout, was too rambly

2026-05-30T19:33:46Z

simplified the capability table to yes/no columns and tightened the prose throughout, was too rambly

Show changes

Louis: added home assistant vs official app capability table so non-technical readers see what was actually lost; dual-cited every row, mostly against vw uk's own services page

2026-05-30T17:48:37Z

added home assistant vs official app capability table so non-technical readers see what was actually lost; dual-cited every row, mostly against vw uk's own services page

Show changes

Louis: fix cs1 date format on pickup truck talk ref

2026-05-29T22:52:42Z

fix cs1 date format on pickup truck talk ref

← Older revision		Revision as of 22:52, 29 May 2026
Line 68:		Line 68:

	* [[Mazda DMCA takedown of open source Home Assistant app\|Mazda]] sent a Digital Millennium Copyright Act takedown to GitHub in 2023, forcing the removal of the open-source libraries used by Home Assistant.<ref name="thedrive">{{Cite web \|url=https://www.thedrive.com/news/mazda-slaps-developer-with-cease-and-desist-for-diy-smart-home-integration \|title=Mazda Slaps Developer With Cease-and-Desist for DIY Smart Home Integration \|publisher=The Drive \|date=2023-10-20 \|access-date=2026-05-29}}</ref>		* [[Mazda DMCA takedown of open source Home Assistant app\|Mazda]] sent a Digital Millennium Copyright Act takedown to GitHub in 2023, forcing the removal of the open-source libraries used by Home Assistant.<ref name="thedrive">{{Cite web \|url=https://www.thedrive.com/news/mazda-slaps-developer-with-cease-and-desist-for-diy-smart-home-integration \|title=Mazda Slaps Developer With Cease-and-Desist for DIY Smart Home Integration \|publisher=The Drive \|date=2023-10-20 \|access-date=2026-05-29}}</ref>
	* Toyota moved remote start, remote climate & other ''Remote Connect'' functions behind a paid subscription that begins after the included trial period.<ref name="pickup">{{Cite web \|url=https://pickuptrucktalk.com/2024/07/buyer-beware-subscription-fees-are-hidden-in-your-new-car/ \|title=Buyer Beware: Subscription Fees Are Hidden In Your New Car \|publisher=Pickup Truck Talk \|date=2024~~-07~~ \|access-date=2026-05-29}}</ref>		* Toyota moved remote start, remote climate & other ''Remote Connect'' functions behind a paid subscription that begins after the included trial period.<ref name="pickup">{{Cite web \|url=https://pickuptrucktalk.com/2024/07/buyer-beware-subscription-fees-are-hidden-in-your-new-car/ \|title=Buyer Beware: Subscription Fees Are Hidden In Your New Car \|publisher=Pickup Truck Talk \|date=July 2024 \|access-date=2026-05-29}}</ref>
	* Stellantis charges $9.99 per month or $109.89 per year for connected navigation across its brands.<ref name="pickup" />		* Stellantis charges $9.99 per month or $109.89 per year for connected navigation across its brands.<ref name="pickup" />
	* General Motors announced the removal of [[Apple CarPlay]] & Android Auto from future EVs.<ref name="pickup" />		* General Motors announced the removal of [[Apple CarPlay]] & Android Auto from future EVs.<ref name="pickup" />

Louis: new article on vw's silent api lockout on may 27, sourced to the github trackers, borncity, schmidtisblog, mobiflip & the eu data act/mass right to repair coverage. mazda dmca parallel linked.

2026-05-29T22:51:52Z

new article on vw's silent api lockout on may 27, sourced to the github trackers, borncity, schmidtisblog, mobiflip & the eu data act/mass right to repair coverage. mazda dmca parallel linked.

New page

{{IncidentCargo
|Company=Volkswagen
|StartDate=2026-05-27
|EndDate=
|Status=Active
|ProductLine=
|Product=
|ArticleType=Service
|Type=Right to Repair,Subscription,Data Access
|Description=VW silently disabled third-party API access on May 27, 2026, breaking Home Assistant & EVCC integrations owners used to read & control their own vehicles.
}}

On May 27, 2026, [[Volkswagen]] Group silently disabled the authentication flow that third-party software had used for years to read & control its vehicles, breaking the widely deployed [[Home Assistant]] integration ''homeassistant-volkswagencarnet'' & the open-source EV charge controller ''evcc''.<ref name="borncity">{{Cite web |url=https://borncity.com/blog/2026/05/29/vw-und-audi-sperren-api-schnittstelle-smart-home-blackout-seit-27-05-2026-teil-1/ |title=VW und Audi sperren API-Schnittstelle; "Smart-Home-Blackout" seit 27.05.2026 - Teil 1 |publisher=Borncity |date=2026-05-29 |access-date=2026-05-29}}</ref><ref name="issue969">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet/issues/969 |title=[BUG] VW has disabled access to API, so any services based on it no longer work. |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |date=2026-05-27 |access-date=2026-05-29}}</ref> The cutover extended across the Volkswagen, [[Audi]], Škoda & Cupra brands.<ref name="myskoda1112">{{Cite web |url=https://github.com/skodaconnect/homeassistant-myskoda/issues/1112 |title=API access change - VW Group third-party framework |publisher=GitHub (skodaconnect/homeassistant-myskoda) |date=2026-05-26 |access-date=2026-05-29}}</ref><ref name="evccdiscussion">{{Cite web |url=https://github.com/evcc-io/evcc/discussions/30236 |title=VW lock API requests soon and allow only registered Apps #30236 |publisher=GitHub (evcc-io/evcc) |date=2026-05-27 |access-date=2026-05-29}}</ref> The new token endpoint requires a cryptographic ''attestation'' tying each request to an official VW Group app, locking out community clients that had previously authenticated with stored owner credentials alone.<ref name="issue969" /><ref name="evccdiscussion" /> Volkswagen published no press release; the official explanation surfaced on a private Škoda owners' Facebook group, telling owners that apps lacking a formalised relationship with VW Group Info Services would no longer be able to access vehicle data.<ref name="myskoda1112" />

== Background ==

The We Connect service is the cloud backend for Volkswagen Group's connected-vehicle features: state-of-charge reporting, remote charge control, climate pre-conditioning, lock & unlock, departure timers, & location. The community ''homeassistant-volkswagencarnet'' integration that exposed those features to home automation began with support for the Passat, Golf, e-Golf, Tiguan, & later expanded to the ID series.<ref name="repo">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet |title=robinostlund/homeassistant-volkswagencarnet (repository description) |publisher=GitHub |access-date=2026-05-29}}</ref>

Volkswagen already monetises consumer access to those features. The German tech press reported that VW had been shifting paid data access toward business customers, with ''Schmidtisblog'' noting that the company ''"verweist bereits auf kostenpflichtige Business-Schnittstellen für Firmenkunden"'' (''"already points to paid business interfaces for corporate customers"'').<ref name="schmidt">{{Cite web |url=https://www.schmidtisblog.de/heimlicher-stecker-gezogen-warum-vw-fahrer-gerade-ihr-smart-home-verlieren-1800546/ |title=Heimlicher Stecker gezogen - Warum VW-Fahrer gerade ihr Smart Home verlieren |last=Schmidt |first=Jörn |publisher=Schmidtis Blog |date=2026-05-28 |access-date=2026-05-29}}</ref>

For owners who wanted to do something the official app could not, such as charging an EV only when rooftop solar generated surplus power, capping state-of-charge at a battery-friendly level, or pre-conditioning the cabin off a calendar entry, the practical answer was the open-source ''homeassistant-volkswagencarnet'' integration maintained on GitHub under the user ''robinostlund''. The repository carried 552 stars, 83 forks & a GPL-3.0 license at the time of the shutdown.<ref name="repo" /> ''evcc'', the open-source EV charge controller used to align home charging with solar production, polled the VW backend every few minutes to read battery state.<ref name="evccrepo">{{Cite web |url=https://github.com/evcc-io/evcc |title=evcc-io/evcc (repository) |publisher=GitHub |access-date=2026-05-29}}</ref><ref name="evccdiscussion" />

== The API shutdown ==

On the afternoon of May 27, 2026, every third-party client targeting the Volkswagen Group cloud began failing simultaneously.<ref name="borncity" /><ref name="issue967">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet/issues/967 |title=[BUG] Login no more possible, Android App still works |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |date=2026-05-27 |access-date=2026-05-29}}</ref> Users reported authentication failures with credentials that had worked the prior day, while the official Volkswagen, Audi & MyŠkoda smartphone apps continued to authenticate normally.<ref name="issue967" /><ref name="issue969" /> The integration logs showed unauthorized, forbidden, & bad-request responses against the VW Group token endpoint.<ref name="evccdiscussion" />

Community analysis of the shipping VW-App build identified the change as a migration of the OIDC token endpoint from ''/login/v1/idk/token'' to ''/auth/v1/idk/oidc/token'', combined with a new requirement that the client prove via cryptographic ''attestation'' that the request originates from an official VW Group app.<ref name="issue969" /><ref name="evccdiscussion" /> Maintainers responded the same day by extracting the attestation parameters from the shipping Volkswagen Android app & restoring access through emulation; fixes shipped within hours as pull requests against ''evcc'' & the ''volkswagencarnet'' Python package.<ref name="issue969" /><ref name="evccdiscussion" /> The change therefore raised the engineering bar for community integrations rather than ending them outright, & continued access depends on maintainers tracking every future VW-App build.

The first public confirmation came from owners filing bug reports against ''homeassistant-volkswagencarnet'' on the afternoon of the cutover, then from a separate issue titled ''"[BUG] VW has disabled access to API, so any services based on it no longer work"'' opened the same day.<ref name="issue967" /><ref name="issue969" />

=== Affected integrations & features ===

The breakage swept across the ecosystem of community-developed VW Group tools, including:

* ''homeassistant-volkswagencarnet'' (Home Assistant, Robin Östlund)<ref name="issue967" /><ref name="issue969" />
* ''evcc'' solar-aware EV charge controller<ref name="evccdiscussion" />
* ''homeassistant-myskoda'' (Škoda)<ref name="myskoda1112" />

Functions that stopped working from the owner's smart-home side, even where the official app still showed them, included state-of-charge reporting, charging control, climate pre-conditioning, lock & unlock, & vehicle location.<ref name="borncity" /><ref name="mobiflip">{{Cite web |url=https://www.mobiflip.de/vw-nutzer-verlieren-ploetzlich-wichtige-smart-home-funktionen/ |title=VW-Nutzer verlieren plötzlich wichtige Smart-Home-Funktionen |last=Hesse |first=René |publisher=Mobiflip |date=2026-05-28 |access-date=2026-05-29}}</ref> Owners who had built automations to charge their EV only against solar surplus, the use case ''evcc'' was written for, lost it overnight: without a polled state-of-charge value from the car, the controller could not decide when to start or stop a charging session.<ref name="evccdiscussion" />

=== Volkswagen's response ===

Volkswagen Group did not issue a press release about the change before the German tech press picked it up on May 28-29, 2026.<ref name="schmidt" /><ref name="mobiflip" />

The official explanation surfaced on a private Škoda owners' Facebook group, posted by VW Group Info Services & reposted by users into the public GitHub trackers. It described the change as a ''"formal framework for third-party access to vehicle data"'' intended to ''"make sure these apps work reliably and your data stays protected,"'' & told owners:

<blockquote>''"Apps without a formalised relationship with VW Group Info Services will no longer be able to access vehicle data. If you use a third-party app and you are not sure whether it is integrated, the best step is to contact the provider directly and ask them to complete the attestation process with VW Group Info Services."''</blockquote><ref name="myskoda1112" />

The attestation programme is a business-to-business product. In September 2024 VW Group Info Services announced an integration with telematics provider Geotab to surface Volkswagen Group vehicle data for commercial fleet customers.<ref name="electrek">{{Cite web |url=https://electrek.co/2025/12/20/oem-telematics-integration-is-maximizing-ev-fleet-efficiency-and-roi/ |title=OEM telematics integration is maximizing EV fleet efficiency and ROI |publisher=Electrek |date=2025-12-20 |access-date=2026-05-29}}</ref> An owner running ''homeassistant-volkswagencarnet'' on a home server is not the target customer.

== Consumer response ==

The ''homeassistant-volkswagencarnet'' tracker accumulated bug reports from European owners, all reporting identical authentication failures with credentials that still worked in the official app.<ref name="issue967" /><ref name="issue969" />

The ''evcc'' maintainers opened a dedicated discussion thread that drew sustained engagement, & explicitly asked participants to keep arguments about suing Volkswagen in a separate thread so the technical work could proceed.<ref name="evccdiscussion" /> Owners across the GitHub threads repeatedly invoked the [[EU Data Act]] as the legal basis on which the lockout should be challenged.<ref name="evccdiscussion" />

Some owners canvassed switching brands. A reader quoted by ''Mobiflip'' wrote that if Volkswagen could not offer a workable interface ''"wie es BMW gemacht hat"'' (''"like BMW has done"''), ''"wird es halt kein VW mehr"'' (''"then it just won't be a VW anymore"'').<ref name="mobiflip" />

== Regulatory context ==

The shutdown lands directly inside the application window of the [[EU Data Act]] (Regulation (EU) 2023/2854), which entered into force on January 11, 2024.<ref name="hunton">{{Cite web |url=https://www.hunton.com/privacy-and-cybersecurity-law-blog/key-provisions-of-the-eu-data-act-take-effect |title=Key Provisions of the EU Data Act Take Effect |publisher=Hunton Andrews Kurth |access-date=2026-05-29}}</ref> The majority of its provisions began to apply on September 12, 2025, & design-by-default obligations on connected products & related services offered in the EU follow after September 12, 2026.<ref name="hunton" /><ref name="latham">{{Cite web |url=https://www.lw.com/en/insights/eu-data-act-what-businesses-need-to-know |title=EU Data Act: What Businesses Need to Know |publisher=Latham & Watkins |access-date=2026-05-29}}</ref> Under Articles 4 & 5 of the regulation, a data holder must, when the user requests it, make readily available data accessible to a designated third party in a structured, commonly used & machine-readable format.<ref name="latham" /><ref name="hunton" />

Whether a Cariad-issued partner-attestation requirement that excludes free-software clients can be reconciled with that obligation is the question owners on the GitHub trackers were raising within hours of the cutover.<ref name="evccdiscussion" /> No regulator had opened a public proceeding against Volkswagen Group over the API shutdown as of late May 2026.

== Pattern of automaker API lockouts ==

The Volkswagen action follows a documented pattern of automakers restricting third-party clients to the data their vehicles emit.

* [[Mazda DMCA takedown of open source Home Assistant app|Mazda]] sent a Digital Millennium Copyright Act takedown to GitHub in 2023, forcing the removal of the open-source libraries used by Home Assistant.<ref name="thedrive">{{Cite web |url=https://www.thedrive.com/news/mazda-slaps-developer-with-cease-and-desist-for-diy-smart-home-integration |title=Mazda Slaps Developer With Cease-and-Desist for DIY Smart Home Integration |publisher=The Drive |date=2023-10-20 |access-date=2026-05-29}}</ref>
* Toyota moved remote start, remote climate & other ''Remote Connect'' functions behind a paid subscription that begins after the included trial period.<ref name="pickup">{{Cite web |url=https://pickuptrucktalk.com/2024/07/buyer-beware-subscription-fees-are-hidden-in-your-new-car/ |title=Buyer Beware: Subscription Fees Are Hidden In Your New Car |publisher=Pickup Truck Talk |date=2024-07 |access-date=2026-05-29}}</ref>
* Stellantis charges $9.99 per month or $109.89 per year for connected navigation across its brands.<ref name="pickup" />
* General Motors announced the removal of [[Apple CarPlay]] & Android Auto from future EVs.<ref name="pickup" />

In the United States the legal frame around owner access to vehicle data has tilted toward owners. On February 11, 2025, U.S. District Judge Denise Casper dismissed the [[Alliance for Automotive Innovation]]'s suit challenging the Massachusetts Data Access Law, which was approved by Massachusetts voters in 2020.<ref name="autocare">{{Cite web |url=https://www.autocare.org/news/latest-news/details/2025/02/11/auto-care-association-applauds-verdict-in-years-long-massachusetts-right-to-repair-battle |title=Auto Care Association Applauds Verdict in Years-Long Massachusetts Right to Repair Battle |publisher=Auto Care Association |date=2025-02-11 |access-date=2026-05-29}}</ref><ref name="wbur">{{Cite web |url=https://www.wbur.org/news/2025/02/12/massachusetts-right-to-repair-carr-law-challenges-dismissed |title=Massachusetts right-to-repair law upheld as judge dismisses automaker challenge |publisher=WBUR |date=2025-02-12 |access-date=2026-05-29}}</ref>

== See also ==

* [[Mazda DMCA takedown of open source Home Assistant app]]
* [[Volkswagen]]
* [[EU Data Act]]
* [[Right to repair]]
* [[Subscription model]]

== References ==

{{reflist}}

[[Category:Volkswagen]]
[[Category:Automotive]]
[[Category:Right to repair]]
[[Category:Subscription model]]
[[Category:Data access]]
[[Category:2026 incidents]]