Volkswagen Carnet API shutdown: Difference between revisions
added home assistant vs official app capability table so non-technical readers see what was actually lost; dual-cited every row, mostly against vw uk's own services page |
simplified the capability table to yes/no columns and tightened the prose throughout, was too rambly |
||
| Line 11: | Line 11: | ||
}} | }} | ||
On May 27, 2026, [[Volkswagen]] Group silently disabled the authentication flow that third-party software had used for years to read & control its vehicles, breaking the widely deployed [[Home Assistant]] integration ''homeassistant-volkswagencarnet'' & the open-source EV charge controller ''evcc''.<ref name="borncity">{{Cite web |url=https://borncity.com/blog/2026/05/29/vw-und-audi-sperren-api-schnittstelle-smart-home-blackout-seit-27-05-2026-teil-1/ |title=VW und Audi sperren API-Schnittstelle; "Smart-Home-Blackout" seit 27.05.2026 - Teil 1 |publisher=Borncity |date=2026-05-29 |access-date=2026-05-29}}</ref><ref name="issue969">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet/issues/969 |title=[BUG] VW has disabled access to API, so any services based on it no longer work. |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |date=2026-05-27 |access-date=2026-05-29}}</ref> The cutover extended across the Volkswagen, [[Audi]], Škoda & Cupra brands.<ref name="myskoda1112">{{Cite web |url=https://github.com/skodaconnect/homeassistant-myskoda/issues/1112 |title=API access change - VW Group third-party framework |publisher=GitHub (skodaconnect/homeassistant-myskoda) |date=2026-05-26 |access-date=2026-05-29}}</ref><ref name="evccdiscussion">{{Cite web |url=https://github.com/evcc-io/evcc/discussions/30236 |title=VW lock API requests soon and allow only registered Apps #30236 |publisher=GitHub (evcc-io/evcc) |date=2026-05-27 |access-date=2026-05-29}}</ref> The new token endpoint requires a cryptographic ''attestation'' tying each request to an official VW Group app, locking out community clients that had | On May 27, 2026, [[Volkswagen]] Group silently disabled the authentication flow that third-party software had used for years to read & control its vehicles, breaking the widely deployed [[Home Assistant]] integration ''homeassistant-volkswagencarnet'' & the open-source EV charge controller ''evcc''.<ref name="borncity">{{Cite web |url=https://borncity.com/blog/2026/05/29/vw-und-audi-sperren-api-schnittstelle-smart-home-blackout-seit-27-05-2026-teil-1/ |title=VW und Audi sperren API-Schnittstelle; "Smart-Home-Blackout" seit 27.05.2026 - Teil 1 |publisher=Borncity |date=2026-05-29 |access-date=2026-05-29}}</ref><ref name="issue969">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet/issues/969 |title=[BUG] VW has disabled access to API, so any services based on it no longer work. |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |date=2026-05-27 |access-date=2026-05-29}}</ref> The cutover extended across the Volkswagen, [[Audi]], Škoda & Cupra brands.<ref name="myskoda1112">{{Cite web |url=https://github.com/skodaconnect/homeassistant-myskoda/issues/1112 |title=API access change - VW Group third-party framework |publisher=GitHub (skodaconnect/homeassistant-myskoda) |date=2026-05-26 |access-date=2026-05-29}}</ref><ref name="evccdiscussion">{{Cite web |url=https://github.com/evcc-io/evcc/discussions/30236 |title=VW lock API requests soon and allow only registered Apps #30236 |publisher=GitHub (evcc-io/evcc) |date=2026-05-27 |access-date=2026-05-29}}</ref> The new token endpoint requires a cryptographic ''attestation'' tying each request to an official VW Group app, locking out community clients that had authenticated with stored owner credentials alone.<ref name="issue969" /><ref name="evccdiscussion" /> Volkswagen published no press release; the official explanation surfaced on a private Škoda owners' Facebook group, telling owners that apps lacking a formalised relationship with VW Group Info Services would no longer access vehicle data.<ref name="myskoda1112" /> | ||
== Background == | == Background == | ||
The We Connect service is the cloud backend for Volkswagen Group's connected-vehicle features: state-of-charge reporting, remote charge control, climate pre-conditioning, lock & unlock, departure timers, & location. The community ''homeassistant-volkswagencarnet'' integration that exposed those features to home automation began with | The We Connect service is the cloud backend for Volkswagen Group's connected-vehicle features: state-of-charge reporting, remote charge control, climate pre-conditioning, lock & unlock, departure timers, & location. The community ''homeassistant-volkswagencarnet'' integration that exposed those features to home automation began with the Passat, Golf, e-Golf & Tiguan, & later expanded to the ID series.<ref name="repo">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet |title=robinostlund/homeassistant-volkswagencarnet (repository description) |publisher=GitHub |access-date=2026-05-29}}</ref> ''evcc'', the open-source EV charge controller used to align home charging with solar production, polled the VW backend periodically to read battery state.<ref name="evccrepo">{{Cite web |url=https://github.com/evcc-io/evcc |title=evcc-io/evcc (repository) |publisher=GitHub |access-date=2026-05-29}}</ref><ref name="evccdiscussion" /> | ||
Volkswagen already monetises consumer access to those features | Volkswagen already monetises consumer access to those features, & ''Schmidtisblog'' reported that the company ''"verweist bereits auf kostenpflichtige Business-Schnittstellen für Firmenkunden"'' (''"already points to paid business interfaces for corporate customers"'').<ref name="schmidt">{{Cite web |url=https://www.schmidtisblog.de/heimlicher-stecker-gezogen-warum-vw-fahrer-gerade-ihr-smart-home-verlieren-1800546/ |title=Heimlicher Stecker gezogen - Warum VW-Fahrer gerade ihr Smart Home verlieren |last=Schmidt |first=Jörn |publisher=Schmidtis Blog |date=2026-05-28 |access-date=2026-05-29}}</ref> | ||
== The API shutdown == | == The API shutdown == | ||
On the afternoon of May 27, 2026, every third-party client targeting the Volkswagen Group cloud began failing simultaneously.<ref name="borncity" /><ref name="issue967">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet/issues/967 |title=[BUG] Login no more possible, Android App still works |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |date=2026-05-27 |access-date=2026-05-29}}</ref | On the afternoon of May 27, 2026, every third-party client targeting the Volkswagen Group cloud began failing simultaneously, while the official Volkswagen, Audi & MyŠkoda smartphone apps continued to authenticate normally.<ref name="borncity" /><ref name="issue967">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet/issues/967 |title=[BUG] Login no more possible, Android App still works |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |date=2026-05-27 |access-date=2026-05-29}}</ref><ref name="issue969" /> Integration logs showed unauthorized, forbidden & bad-request responses against the VW Group token endpoint.<ref name="evccdiscussion" /> | ||
Community analysis of the shipping VW-App build identified the change as a migration of the OIDC token endpoint from ''/login/v1/idk/token'' to ''/auth/v1/idk/oidc/token'', combined with a new requirement that the client prove via cryptographic ''attestation'' that the request originates from an official VW Group app.<ref name="evccdiscussion" /> Maintainers responded the same day by extracting the attestation parameters from the shipping Volkswagen Android app & restoring access through emulation; fixes shipped within hours as pull requests against ''evcc'' & the ''volkswagencarnet'' Python package.<ref name="evccdiscussion" /> The change | Community analysis of the shipping VW-App build identified the change as a migration of the OIDC token endpoint from ''/login/v1/idk/token'' to ''/auth/v1/idk/oidc/token'', combined with a new requirement that the client prove via cryptographic ''attestation'' that the request originates from an official VW Group app.<ref name="evccdiscussion" /> Maintainers responded the same day by extracting the attestation parameters from the shipping Volkswagen Android app & restoring access through emulation; fixes shipped within hours as pull requests against ''evcc'' & the ''volkswagencarnet'' Python package.<ref name="evccdiscussion" /> The change raised the engineering bar for community integrations rather than ending them outright, & continued access depends on maintainers tracking every future VW-App build. | ||
=== Affected integrations & features === | === Affected integrations & features === | ||
The breakage | The breakage hit every community-developed VW Group tool in active use: | ||
* ''homeassistant-volkswagencarnet'' (Home Assistant, Robin Östlund)<ref name="issue967" /><ref name="issue969" /> | * ''homeassistant-volkswagencarnet'' (Home Assistant, Robin Östlund)<ref name="issue967" /><ref name="issue969" /> | ||
| Line 37: | Line 33: | ||
* ''homeassistant-myskoda'' (Škoda)<ref name="myskoda1112" /> | * ''homeassistant-myskoda'' (Škoda)<ref name="myskoda1112" /> | ||
Functions that stopped working from the owner's smart-home side, even where the official app still showed them, included state-of-charge reporting, charging control, climate pre-conditioning, lock & unlock, & vehicle location.<ref name="borncity" /><ref name="mobiflip">{{Cite web |url=https://www.mobiflip.de/vw-nutzer-verlieren-ploetzlich-wichtige-smart-home-funktionen/ |title=VW-Nutzer verlieren plötzlich wichtige Smart-Home-Funktionen |last=Hesse |first=René |publisher=Mobiflip |date=2026-05-28 |access-date=2026-05-29}}</ref | Functions that stopped working from the owner's smart-home side, even where the official app still showed them, included state-of-charge reporting, charging control, climate pre-conditioning, lock & unlock, & vehicle location.<ref name="borncity" /><ref name="mobiflip">{{Cite web |url=https://www.mobiflip.de/vw-nutzer-verlieren-ploetzlich-wichtige-smart-home-funktionen/ |title=VW-Nutzer verlieren plötzlich wichtige Smart-Home-Funktionen |last=Hesse |first=René |publisher=Mobiflip |date=2026-05-28 |access-date=2026-05-29}}</ref> | ||
=== Home Assistant capabilities not available in the official app === | === Home Assistant capabilities not available in the official app === | ||
The community integrations were not a re-skin of the official Volkswagen app. They exposed each vehicle as | The community integrations were not a re-skin of the official Volkswagen app. They exposed each vehicle as writable Home Assistant entities (switches, numbers, selects, device trackers, locks, climate controls) that any automation, dashboard, time-series database, voice assistant or external script could read & command. The Volkswagen, MyAudi, MyŠkoda & Cupra apps are closed mobile clients with a fixed UI, & many of their headline remote-control features sit behind the paid We Connect Plus subscription priced on Volkswagen UK's services page at £129 per year.<ref name="vwallservices">{{Cite web |url=https://www.volkswagen.co.uk/en/connected-services/vw-connect-id/all-services.html |title=VW Connect ID. - All Services |publisher=Volkswagen UK |access-date=2026-05-30}}</ref><ref name="id3plus">{{Cite web |url=https://www.id3forums.co.uk/viewtopic.php?t=3958 |title=WeConnect Plus app charges - free or not for older cars? |publisher=Volkswagen ID.3 Forum |date=2025-07-03 |access-date=2026-05-30}}</ref> | ||
{| class="wikitable" | {| class="wikitable" | ||
! Capability !! Home Assistant integration / ''evcc'' !! Official | ! Capability !! Home Assistant integration / ''evcc'' !! Official VW / MyAudi / MyŠkoda / Cupra app | ||
|- | |- | ||
| Charge only on rooftop solar surplus || '' | | Charge only on rooftop solar surplus || '''Yes'''<ref name="evccsolar">{{Cite web |url=https://docs.evcc.io/en/features/solar-charging/ |title=Solar Surplus Charging |publisher=evcc documentation |access-date=2026-05-30}}</ref> || '''No'''<ref name="ellisolar">{{Cite web |url=https://www.volkswagen-group.com/en/press-releases/volkswagen-group-brand-elli-launches-smart-charging-product-offensive-for-europe-18724 |title=Volkswagen Group brand Elli launches smart charging product offensive for Europe |publisher=Volkswagen Group |access-date=2026-05-30}}</ref> | ||
|- | |- | ||
| Charge on a dynamic electricity tariff || '' | | Charge on a dynamic electricity tariff || '''Yes'''<ref name="evcctariffs">{{Cite web |url=https://docs.evcc.io/en/tariffs/ |title=Tariffs & forecasts |publisher=evcc documentation |access-date=2026-05-30}}</ref> || '''No'''<ref name="ellisolar" /> | ||
|- | |- | ||
| Force a cloud data refresh on demand || '' | | Force a cloud data refresh on demand || '''Yes'''<ref name="vwdash">{{Cite web |url=https://github.com/robinostlund/volkswagencarnet/blob/master/volkswagencarnet/vw_dashboard.py |title=vw_dashboard.py source (RequestUpdate, Charging, DepartureTimer, BatteryTargetSOC, ScanInterval, ChargeMaxACAmpere, ElectricClimatisation, DoorLock, Position) |publisher=GitHub (robinostlund/volkswagencarnet) |access-date=2026-05-30}}</ref> || '''No'''<ref name="vwallservices" /> | ||
|- | |- | ||
| Configurable polling interval per vehicle || | | Configurable polling interval per vehicle || '''Yes'''<ref name="harepo">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet |title=Volkswagen Connect for Home Assistant (README) |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |access-date=2026-05-30}}</ref> || '''No'''<ref name="vwallservices" /> | ||
|- | |- | ||
| Read instantaneous charge power in kilowatts || | | Read instantaneous charge power in kilowatts || '''Yes'''<ref name="vwdash" /> || '''No'''<ref name="zanatta">{{Cite web |url=https://www.davidezanatta.com/blog/volkswagen-weconnect-id-in-home-assistant-and-custom-dashboard-for-id-3/?lang=en |title=Volkswagen WeConnect ID in Home Assistant and Custom Dashboard for ID.3 |last=Zanatta |first=Davide |access-date=2026-05-30}}</ref> | ||
|- | |- | ||
| Cap AC charging current in amperes || | | Cap AC charging current in amperes || '''Yes'''<ref name="vwdash" /> || '''No'''<ref name="vwallservices" /> | ||
|- | |- | ||
| Multiple departure timers with scriptable conditions || | | Multiple departure timers with scriptable conditions || '''Yes'''<ref name="haservices">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet/blob/master/custom_components/volkswagencarnet/services.yaml |title=services.yaml (update_schedule service) |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |access-date=2026-05-30}}</ref> || '''No'''<ref name="vwallservices" /> | ||
|- | |- | ||
| Pre-condition cabin from weather, calendar or geofence || | | Pre-condition cabin from weather, calendar or geofence || '''Yes'''<ref name="hacommunity">{{Cite web |url=https://community.home-assistant.io/t/custom-integration-volkswagen-weconnect-id-europe/380933 |title=Custom Integration: Volkswagen WeConnect ID (Europe) |publisher=Home Assistant Community |access-date=2026-05-30}}</ref> || '''No'''<ref name="vwallservices" /> | ||
|- | |- | ||
| User-defined notifications on charge events || | | User-defined notifications on charge events || '''Yes'''<ref name="hacommunity" /> || '''No'''<ref name="vwallservices" /> | ||
|- | |- | ||
| Multi-vehicle, multi-brand single dashboard || | | Multi-vehicle, multi-brand single dashboard || '''Yes'''<ref name="harepo" /> || '''No'''<ref name="vwallservices" /> | ||
|- | |- | ||
| Long-term historisation of every reading || | | Long-term historisation of every reading || '''Yes'''<ref name="harecorder">{{Cite web |url=https://www.home-assistant.io/integrations/recorder/ |title=Recorder |publisher=Home Assistant |access-date=2026-05-30}}</ref> || '''No'''<ref name="vwallservices" /> | ||
|- | |- | ||
| Open egress over MQTT for external consumers || | | Open egress over MQTT for external consumers || '''Yes'''<ref name="wcmqtt">{{Cite web |url=https://github.com/tillsteinbach/WeConnect-mqtt |title=tillsteinbach/WeConnect-mqtt |publisher=GitHub |access-date=2026-05-30}}</ref> || '''No'''<ref name="vwallservices" /> | ||
|- | |- | ||
| Door lock & unlock as an automation primitive || | | Door lock & unlock as an automation primitive || '''Yes'''<ref name="vwdash" /> || '''No'''<ref name="vwallservices" /> | ||
|- | |- | ||
| Vehicle location as a Home Assistant | | Vehicle location as a Home Assistant device tracker || '''Yes'''<ref name="vwdash" /> || '''No'''<ref name="vwallservices" /> | ||
|- | |- | ||
| Voice control through Apple HomeKit || | | Voice control through Apple HomeKit || '''Yes'''<ref name="hacommunity" /> || '''No'''<ref name="vwweconnectstart">{{Cite web |url=https://www.volkswagen.co.uk/en/connected-services/vw-connect-id/we-connect-start.html |title=We Connect Start |publisher=Volkswagen UK |access-date=2026-05-30}}</ref> | ||
|- | |- | ||
| Free, no-subscription remote charge & climate control || | | Free, no-subscription remote charge & climate control || '''Yes'''<ref name="harepo" /> || '''No'''<ref name="vwallservices" /> | ||
|} | |} | ||
=== Volkswagen's response === | === Volkswagen's response === | ||
Volkswagen Group | Volkswagen Group issued no press release before the German tech press picked up the change on May 28-29, 2026.<ref name="schmidt" /><ref name="mobiflip" /> The official explanation surfaced on a private Škoda owners' Facebook group, posted by VW Group Info Services & reposted into the public GitHub trackers. It described the change as a ''"formal framework for third-party access to vehicle data"'' intended to ''"make sure these apps work reliably and your data stays protected,"'' & told owners: | ||
The official explanation surfaced on a private Škoda owners' Facebook group, posted by VW Group Info Services & reposted | |||
<blockquote>''"Apps without a formalised relationship with VW Group Info Services will no longer be able to access vehicle data. If you use a third-party app and you are not sure whether it is integrated, the best step is to contact the provider directly and ask them to complete the attestation process with VW Group Info Services."''</blockquote><ref name="myskoda1112" /> | <blockquote>''"Apps without a formalised relationship with VW Group Info Services will no longer be able to access vehicle data. If you use a third-party app and you are not sure whether it is integrated, the best step is to contact the provider directly and ask them to complete the attestation process with VW Group Info Services."''</blockquote><ref name="myskoda1112" /> | ||
| Line 90: | Line 85: | ||
== Consumer response == | == Consumer response == | ||
The ''homeassistant-volkswagencarnet'' tracker accumulated bug reports from European owners, all reporting identical authentication failures with credentials that still worked in the official app.<ref name="issue967" /><ref name="issue969" /> | The ''homeassistant-volkswagencarnet'' tracker accumulated bug reports from European owners, all reporting identical authentication failures with credentials that still worked in the official app.<ref name="issue967" /><ref name="issue969" /> The ''evcc'' maintainers opened a dedicated discussion thread & asked participants to keep arguments about suing Volkswagen in a separate thread so the technical work could proceed; owners across the GitHub threads repeatedly invoked the [[EU Data Act]] as the legal basis on which the lockout should be challenged.<ref name="evccdiscussion" /> | ||
The ''evcc'' maintainers opened a dedicated discussion thread | |||
A reader quoted by ''Mobiflip'' wrote that if Volkswagen could not offer a workable interface ''"wie es BMW gemacht hat"'' (''"like BMW has done"''), ''"wird es halt kein VW mehr"'' (''"then it just won't be a VW anymore"'').<ref name="mobiflip" /> | |||
== Regulatory context == | == Regulatory context == | ||
The [[EU Data Act]] (Regulation (EU) 2023/2854) entered into force on January 11, 2024.<ref name="hunton">{{Cite web |url=https://www.hunton.com/privacy-and-cybersecurity-law-blog/key-provisions-of-the-eu-data-act-take-effect |title=Key Provisions of the EU Data Act Take Effect |publisher=Hunton Andrews Kurth |access-date=2026-05-29}}</ref> The majority of its provisions began to apply on September 12, 2025, & design-by-default obligations on connected products & related services offered in the EU follow after September 12, 2026.<ref name="hunton" /><ref name="latham">{{Cite web |url=https://www.lw.com/en/insights/eu-data-act-what-businesses-need-to-know |title=EU Data Act: What Businesses Need to Know |publisher=Latham & Watkins |access-date=2026-05-29}}</ref> Under Articles 4 & 5 | The [[EU Data Act]] (Regulation (EU) 2023/2854) entered into force on January 11, 2024.<ref name="hunton">{{Cite web |url=https://www.hunton.com/privacy-and-cybersecurity-law-blog/key-provisions-of-the-eu-data-act-take-effect |title=Key Provisions of the EU Data Act Take Effect |publisher=Hunton Andrews Kurth |access-date=2026-05-29}}</ref> The majority of its provisions began to apply on September 12, 2025, & design-by-default obligations on connected products & related services offered in the EU follow after September 12, 2026.<ref name="hunton" /><ref name="latham">{{Cite web |url=https://www.lw.com/en/insights/eu-data-act-what-businesses-need-to-know |title=EU Data Act: What Businesses Need to Know |publisher=Latham & Watkins |access-date=2026-05-29}}</ref> Under Articles 4 & 5, a data holder must, when the user requests it, make readily available data accessible to a designated third party in a structured, commonly used & machine-readable format.<ref name="latham" /><ref name="hunton" /> | ||
Within hours of the cutover, owners on the GitHub trackers argued that a Cariad-issued partner-attestation requirement that excludes free-software clients cannot be reconciled with that Article 4 / Article 5 obligation.<ref name="evccdiscussion" /> | Within hours of the cutover, owners on the GitHub trackers argued that a Cariad-issued partner-attestation requirement that excludes free-software clients cannot be reconciled with that Article 4 / Article 5 obligation.<ref name="evccdiscussion" /> | ||
== Pattern of automaker API lockouts == | == Pattern of automaker API lockouts == | ||
| Line 111: | Line 104: | ||
* General Motors announced the removal of [[Apple CarPlay]] & Android Auto from future EVs.<ref name="pickup" /> | * General Motors announced the removal of [[Apple CarPlay]] & Android Auto from future EVs.<ref name="pickup" /> | ||
In the United States | In the United States, on February 11, 2025, U.S. District Judge Denise Casper dismissed the [[Alliance for Automotive Innovation]]'s suit challenging the Massachusetts Data Access Law, which Massachusetts voters approved in 2020.<ref name="autocare">{{Cite web |url=https://www.autocare.org/news/latest-news/details/2025/02/11/auto-care-association-applauds-verdict-in-years-long-massachusetts-right-to-repair-battle |title=Auto Care Association Applauds Verdict in Years-Long Massachusetts Right to Repair Battle |publisher=Auto Care Association |date=2025-02-11 |access-date=2026-05-29}}</ref><ref name="wbur">{{Cite web |url=https://www.wbur.org/news/2025/02/12/massachusetts-right-to-repair-carr-law-challenges-dismissed |title=Massachusetts right-to-repair law upheld as judge dismisses automaker challenge |publisher=WBUR |date=2025-02-12 |access-date=2026-05-29}}</ref> | ||
== See also == | == See also == | ||
Revision as of 19:33, 30 May 2026
On May 27, 2026, Volkswagen Group silently disabled the authentication flow that third-party software had used for years to read & control its vehicles, breaking the widely deployed Home Assistant integration homeassistant-volkswagencarnet & the open-source EV charge controller evcc.[1][2] The cutover extended across the Volkswagen, Audi, Škoda & Cupra brands.[3][4] The new token endpoint requires a cryptographic attestation tying each request to an official VW Group app, locking out community clients that had authenticated with stored owner credentials alone.[2][4] Volkswagen published no press release; the official explanation surfaced on a private Škoda owners' Facebook group, telling owners that apps lacking a formalised relationship with VW Group Info Services would no longer access vehicle data.[3]
Background
The We Connect service is the cloud backend for Volkswagen Group's connected-vehicle features: state-of-charge reporting, remote charge control, climate pre-conditioning, lock & unlock, departure timers, & location. The community homeassistant-volkswagencarnet integration that exposed those features to home automation began with the Passat, Golf, e-Golf & Tiguan, & later expanded to the ID series.[5] evcc, the open-source EV charge controller used to align home charging with solar production, polled the VW backend periodically to read battery state.[6][4]
Volkswagen already monetises consumer access to those features, & Schmidtisblog reported that the company "verweist bereits auf kostenpflichtige Business-Schnittstellen für Firmenkunden" ("already points to paid business interfaces for corporate customers").[7]
The API shutdown
On the afternoon of May 27, 2026, every third-party client targeting the Volkswagen Group cloud began failing simultaneously, while the official Volkswagen, Audi & MyŠkoda smartphone apps continued to authenticate normally.[1][8][2] Integration logs showed unauthorized, forbidden & bad-request responses against the VW Group token endpoint.[4]
Community analysis of the shipping VW-App build identified the change as a migration of the OIDC token endpoint from /login/v1/idk/token to /auth/v1/idk/oidc/token, combined with a new requirement that the client prove via cryptographic attestation that the request originates from an official VW Group app.[4] Maintainers responded the same day by extracting the attestation parameters from the shipping Volkswagen Android app & restoring access through emulation; fixes shipped within hours as pull requests against evcc & the volkswagencarnet Python package.[4] The change raised the engineering bar for community integrations rather than ending them outright, & continued access depends on maintainers tracking every future VW-App build.
Affected integrations & features
The breakage hit every community-developed VW Group tool in active use:
- homeassistant-volkswagencarnet (Home Assistant, Robin Östlund)[8][2]
- evcc solar-aware EV charge controller[4]
- homeassistant-myskoda (Škoda)[3]
Functions that stopped working from the owner's smart-home side, even where the official app still showed them, included state-of-charge reporting, charging control, climate pre-conditioning, lock & unlock, & vehicle location.[1][9]
Home Assistant capabilities not available in the official app
The community integrations were not a re-skin of the official Volkswagen app. They exposed each vehicle as writable Home Assistant entities (switches, numbers, selects, device trackers, locks, climate controls) that any automation, dashboard, time-series database, voice assistant or external script could read & command. The Volkswagen, MyAudi, MyŠkoda & Cupra apps are closed mobile clients with a fixed UI, & many of their headline remote-control features sit behind the paid We Connect Plus subscription priced on Volkswagen UK's services page at £129 per year.[10][11]
| Capability | Home Assistant integration / evcc | Official VW / MyAudi / MyŠkoda / Cupra app |
|---|---|---|
| Charge only on rooftop solar surplus | Yes[12] | No[13] |
| Charge on a dynamic electricity tariff | Yes[14] | No[13] |
| Force a cloud data refresh on demand | Yes[15] | No[10] |
| Configurable polling interval per vehicle | Yes[16] | No[10] |
| Read instantaneous charge power in kilowatts | Yes[15] | No[17] |
| Cap AC charging current in amperes | Yes[15] | No[10] |
| Multiple departure timers with scriptable conditions | Yes[18] | No[10] |
| Pre-condition cabin from weather, calendar or geofence | Yes[19] | No[10] |
| User-defined notifications on charge events | Yes[19] | No[10] |
| Multi-vehicle, multi-brand single dashboard | Yes[16] | No[10] |
| Long-term historisation of every reading | Yes[20] | No[10] |
| Open egress over MQTT for external consumers | Yes[21] | No[10] |
| Door lock & unlock as an automation primitive | Yes[15] | No[10] |
| Vehicle location as a Home Assistant device tracker | Yes[15] | No[10] |
| Voice control through Apple HomeKit | Yes[19] | No[22] |
| Free, no-subscription remote charge & climate control | Yes[16] | No[10] |
Volkswagen's response
Volkswagen Group issued no press release before the German tech press picked up the change on May 28-29, 2026.[7][9] The official explanation surfaced on a private Škoda owners' Facebook group, posted by VW Group Info Services & reposted into the public GitHub trackers. It described the change as a "formal framework for third-party access to vehicle data" intended to "make sure these apps work reliably and your data stays protected," & told owners:
"Apps without a formalised relationship with VW Group Info Services will no longer be able to access vehicle data. If you use a third-party app and you are not sure whether it is integrated, the best step is to contact the provider directly and ask them to complete the attestation process with VW Group Info Services."
The attestation programme is a business-to-business product. In September 2024 VW Group Info Services announced an integration with telematics provider Geotab to surface Volkswagen Group vehicle data for commercial fleet customers.[23] An owner running homeassistant-volkswagencarnet on a home server is not the target customer.
Consumer response
The homeassistant-volkswagencarnet tracker accumulated bug reports from European owners, all reporting identical authentication failures with credentials that still worked in the official app.[8][2] The evcc maintainers opened a dedicated discussion thread & asked participants to keep arguments about suing Volkswagen in a separate thread so the technical work could proceed; owners across the GitHub threads repeatedly invoked the EU Data Act as the legal basis on which the lockout should be challenged.[4]
A reader quoted by Mobiflip wrote that if Volkswagen could not offer a workable interface "wie es BMW gemacht hat" ("like BMW has done"), "wird es halt kein VW mehr" ("then it just won't be a VW anymore").[9]
Regulatory context
The EU Data Act (Regulation (EU) 2023/2854) entered into force on January 11, 2024.[24] The majority of its provisions began to apply on September 12, 2025, & design-by-default obligations on connected products & related services offered in the EU follow after September 12, 2026.[24][25] Under Articles 4 & 5, a data holder must, when the user requests it, make readily available data accessible to a designated third party in a structured, commonly used & machine-readable format.[25][24]
Within hours of the cutover, owners on the GitHub trackers argued that a Cariad-issued partner-attestation requirement that excludes free-software clients cannot be reconciled with that Article 4 / Article 5 obligation.[4]
Pattern of automaker API lockouts
Mazda, Toyota, Stellantis & General Motors have each restricted or monetised owner access to vehicle data in the preceding three years.
- Mazda sent a Digital Millennium Copyright Act takedown to GitHub in 2023, forcing the removal of the open-source libraries used by Home Assistant.[26]
- Toyota moved remote start, remote climate & other Remote Connect functions behind a paid subscription that begins after the included trial period.[27]
- Stellantis charges $9.99 per month or $109.89 per year for connected navigation across its brands.[27]
- General Motors announced the removal of Apple CarPlay & Android Auto from future EVs.[27]
In the United States, on February 11, 2025, U.S. District Judge Denise Casper dismissed the Alliance for Automotive Innovation's suit challenging the Massachusetts Data Access Law, which Massachusetts voters approved in 2020.[28][29]
See also
- Mazda DMCA takedown of open source Home Assistant app
- Volkswagen
- EU Data Act
- Right to repair
- Subscription model
References
- ↑ 1.0 1.1 1.2 "VW und Audi sperren API-Schnittstelle; "Smart-Home-Blackout" seit 27.05.2026 - Teil 1". Borncity. 2026-05-29. Retrieved 2026-05-29.
- ↑ 2.0 2.1 2.2 2.3 2.4 "[BUG] VW has disabled access to API, so any services based on it no longer work". GitHub (robinostlund/homeassistant-volkswagencarnet). 2026-05-27. Retrieved 2026-05-29.
- ↑ 3.0 3.1 3.2 3.3 "API access change - VW Group third-party framework". GitHub (skodaconnect/homeassistant-myskoda). 2026-05-26. Retrieved 2026-05-29.
- ↑ 4.0 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 "VW lock API requests soon and allow only registered Apps #30236". GitHub (evcc-io/evcc). 2026-05-27. Retrieved 2026-05-29.
- ↑ "robinostlund/homeassistant-volkswagencarnet (repository description)". GitHub. Retrieved 2026-05-29.
- ↑ "evcc-io/evcc (repository)". GitHub. Retrieved 2026-05-29.
- ↑ 7.0 7.1 Schmidt, Jörn (2026-05-28). "Heimlicher Stecker gezogen - Warum VW-Fahrer gerade ihr Smart Home verlieren". Schmidtis Blog. Retrieved 2026-05-29.
- ↑ 8.0 8.1 8.2 "[BUG] Login no more possible, Android App still works". GitHub (robinostlund/homeassistant-volkswagencarnet). 2026-05-27. Retrieved 2026-05-29.
- ↑ 9.0 9.1 9.2 Hesse, René (2026-05-28). "VW-Nutzer verlieren plötzlich wichtige Smart-Home-Funktionen". Mobiflip. Retrieved 2026-05-29.
- ↑ 10.00 10.01 10.02 10.03 10.04 10.05 10.06 10.07 10.08 10.09 10.10 10.11 10.12 "VW Connect ID. - All Services". Volkswagen UK. Retrieved 2026-05-30.
- ↑ "WeConnect Plus app charges - free or not for older cars?". Volkswagen ID.3 Forum. 2025-07-03. Retrieved 2026-05-30.
- ↑ "Solar Surplus Charging". evcc documentation. Retrieved 2026-05-30.
- ↑ 13.0 13.1 "Volkswagen Group brand Elli launches smart charging product offensive for Europe". Volkswagen Group. Retrieved 2026-05-30.
- ↑ "Tariffs & forecasts". evcc documentation. Retrieved 2026-05-30.
- ↑ 15.0 15.1 15.2 15.3 15.4 "vw_dashboard.py source (RequestUpdate, Charging, DepartureTimer, BatteryTargetSOC, ScanInterval, ChargeMaxACAmpere, ElectricClimatisation, DoorLock, Position)". GitHub (robinostlund/volkswagencarnet). Retrieved 2026-05-30.
- ↑ 16.0 16.1 16.2 "Volkswagen Connect for Home Assistant (README)". GitHub (robinostlund/homeassistant-volkswagencarnet). Retrieved 2026-05-30.
- ↑ Zanatta, Davide. "Volkswagen WeConnect ID in Home Assistant and Custom Dashboard for ID.3". Retrieved 2026-05-30.
- ↑ "services.yaml (update_schedule service)". GitHub (robinostlund/homeassistant-volkswagencarnet). Retrieved 2026-05-30.
- ↑ 19.0 19.1 19.2 "Custom Integration: Volkswagen WeConnect ID (Europe)". Home Assistant Community. Retrieved 2026-05-30.
- ↑ "Recorder". Home Assistant. Retrieved 2026-05-30.
- ↑ "tillsteinbach/WeConnect-mqtt". GitHub. Retrieved 2026-05-30.
- ↑ "We Connect Start". Volkswagen UK. Retrieved 2026-05-30.
- ↑ "OEM telematics integration is maximizing EV fleet efficiency and ROI". Electrek. 2025-12-20. Retrieved 2026-05-29.
- ↑ 24.0 24.1 24.2 "Key Provisions of the EU Data Act Take Effect". Hunton Andrews Kurth. Retrieved 2026-05-29.
- ↑ 25.0 25.1 "EU Data Act: What Businesses Need to Know". Latham & Watkins. Retrieved 2026-05-29.
- ↑ "Mazda Slaps Developer With Cease-and-Desist for DIY Smart Home Integration". The Drive. 2023-10-20. Retrieved 2026-05-29.
- ↑ 27.0 27.1 27.2 "Buyer Beware: Subscription Fees Are Hidden In Your New Car". Pickup Truck Talk. July 2024. Retrieved 2026-05-29.
- ↑ "Auto Care Association Applauds Verdict in Years-Long Massachusetts Right to Repair Battle". Auto Care Association. 2025-02-11. Retrieved 2026-05-29.
- ↑ "Massachusetts right-to-repair law upheld as judge dismisses automaker challenge". WBUR. 2025-02-12. Retrieved 2026-05-29.