Jump to content

Volkswagen Carnet API shutdown: Difference between revisions

From Consumer Rights Wiki
added home assistant vs official app capability table so non-technical readers see what was actually lost; dual-cited every row, mostly against vw uk's own services page
simplified the capability table to yes/no columns and tightened the prose throughout, was too rambly
Line 11: Line 11:
}}
}}


On May 27, 2026, [[Volkswagen]] Group silently disabled the authentication flow that third-party software had used for years to read & control its vehicles, breaking the widely deployed [[Home Assistant]] integration ''homeassistant-volkswagencarnet'' & the open-source EV charge controller ''evcc''.<ref name="borncity">{{Cite web |url=https://borncity.com/blog/2026/05/29/vw-und-audi-sperren-api-schnittstelle-smart-home-blackout-seit-27-05-2026-teil-1/ |title=VW und Audi sperren API-Schnittstelle; "Smart-Home-Blackout" seit 27.05.2026 - Teil 1 |publisher=Borncity |date=2026-05-29 |access-date=2026-05-29}}</ref><ref name="issue969">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet/issues/969 |title=[BUG] VW has disabled access to API, so any services based on it no longer work. |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |date=2026-05-27 |access-date=2026-05-29}}</ref> The cutover extended across the Volkswagen, [[Audi]], Škoda & Cupra brands.<ref name="myskoda1112">{{Cite web |url=https://github.com/skodaconnect/homeassistant-myskoda/issues/1112 |title=API access change - VW Group third-party framework |publisher=GitHub (skodaconnect/homeassistant-myskoda) |date=2026-05-26 |access-date=2026-05-29}}</ref><ref name="evccdiscussion">{{Cite web |url=https://github.com/evcc-io/evcc/discussions/30236 |title=VW lock API requests soon and allow only registered Apps #30236 |publisher=GitHub (evcc-io/evcc) |date=2026-05-27 |access-date=2026-05-29}}</ref> The new token endpoint requires a cryptographic ''attestation'' tying each request to an official VW Group app, locking out community clients that had previously authenticated with stored owner credentials alone.<ref name="issue969" /><ref name="evccdiscussion" /> Volkswagen published no press release; the official explanation surfaced on a private Škoda owners' Facebook group, telling owners that apps lacking a formalised relationship with VW Group Info Services would no longer be able to access vehicle data.<ref name="myskoda1112" />
On May 27, 2026, [[Volkswagen]] Group silently disabled the authentication flow that third-party software had used for years to read & control its vehicles, breaking the widely deployed [[Home Assistant]] integration ''homeassistant-volkswagencarnet'' & the open-source EV charge controller ''evcc''.<ref name="borncity">{{Cite web |url=https://borncity.com/blog/2026/05/29/vw-und-audi-sperren-api-schnittstelle-smart-home-blackout-seit-27-05-2026-teil-1/ |title=VW und Audi sperren API-Schnittstelle; "Smart-Home-Blackout" seit 27.05.2026 - Teil 1 |publisher=Borncity |date=2026-05-29 |access-date=2026-05-29}}</ref><ref name="issue969">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet/issues/969 |title=[BUG] VW has disabled access to API, so any services based on it no longer work. |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |date=2026-05-27 |access-date=2026-05-29}}</ref> The cutover extended across the Volkswagen, [[Audi]], Škoda & Cupra brands.<ref name="myskoda1112">{{Cite web |url=https://github.com/skodaconnect/homeassistant-myskoda/issues/1112 |title=API access change - VW Group third-party framework |publisher=GitHub (skodaconnect/homeassistant-myskoda) |date=2026-05-26 |access-date=2026-05-29}}</ref><ref name="evccdiscussion">{{Cite web |url=https://github.com/evcc-io/evcc/discussions/30236 |title=VW lock API requests soon and allow only registered Apps #30236 |publisher=GitHub (evcc-io/evcc) |date=2026-05-27 |access-date=2026-05-29}}</ref> The new token endpoint requires a cryptographic ''attestation'' tying each request to an official VW Group app, locking out community clients that had authenticated with stored owner credentials alone.<ref name="issue969" /><ref name="evccdiscussion" /> Volkswagen published no press release; the official explanation surfaced on a private Škoda owners' Facebook group, telling owners that apps lacking a formalised relationship with VW Group Info Services would no longer access vehicle data.<ref name="myskoda1112" />


== Background ==
== Background ==


The We Connect service is the cloud backend for Volkswagen Group's connected-vehicle features: state-of-charge reporting, remote charge control, climate pre-conditioning, lock & unlock, departure timers, & location. The community ''homeassistant-volkswagencarnet'' integration that exposed those features to home automation began with support for the Passat, Golf, e-Golf, Tiguan, & later expanded to the ID series.<ref name="repo">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet |title=robinostlund/homeassistant-volkswagencarnet (repository description) |publisher=GitHub |access-date=2026-05-29}}</ref>
The We Connect service is the cloud backend for Volkswagen Group's connected-vehicle features: state-of-charge reporting, remote charge control, climate pre-conditioning, lock & unlock, departure timers, & location. The community ''homeassistant-volkswagencarnet'' integration that exposed those features to home automation began with the Passat, Golf, e-Golf & Tiguan, & later expanded to the ID series.<ref name="repo">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet |title=robinostlund/homeassistant-volkswagencarnet (repository description) |publisher=GitHub |access-date=2026-05-29}}</ref> ''evcc'', the open-source EV charge controller used to align home charging with solar production, polled the VW backend periodically to read battery state.<ref name="evccrepo">{{Cite web |url=https://github.com/evcc-io/evcc |title=evcc-io/evcc (repository) |publisher=GitHub |access-date=2026-05-29}}</ref><ref name="evccdiscussion" />


Volkswagen already monetises consumer access to those features. The German tech press reported that VW had been shifting paid data access toward business customers, with ''Schmidtisblog'' noting that the company ''"verweist bereits auf kostenpflichtige Business-Schnittstellen für Firmenkunden"'' (''"already points to paid business interfaces for corporate customers"'').<ref name="schmidt">{{Cite web |url=https://www.schmidtisblog.de/heimlicher-stecker-gezogen-warum-vw-fahrer-gerade-ihr-smart-home-verlieren-1800546/ |title=Heimlicher Stecker gezogen - Warum VW-Fahrer gerade ihr Smart Home verlieren |last=Schmidt |first=Jörn |publisher=Schmidtis Blog |date=2026-05-28 |access-date=2026-05-29}}</ref>
Volkswagen already monetises consumer access to those features, & ''Schmidtisblog'' reported that the company ''"verweist bereits auf kostenpflichtige Business-Schnittstellen für Firmenkunden"'' (''"already points to paid business interfaces for corporate customers"'').<ref name="schmidt">{{Cite web |url=https://www.schmidtisblog.de/heimlicher-stecker-gezogen-warum-vw-fahrer-gerade-ihr-smart-home-verlieren-1800546/ |title=Heimlicher Stecker gezogen - Warum VW-Fahrer gerade ihr Smart Home verlieren |last=Schmidt |first=Jörn |publisher=Schmidtis Blog |date=2026-05-28 |access-date=2026-05-29}}</ref>
 
For owners who wanted to do something the official app could not, such as charging an EV only when rooftop solar generated surplus power, capping state-of-charge at a battery-friendly level, or pre-conditioning the cabin off a calendar entry, the practical answer was the open-source ''homeassistant-volkswagencarnet'' integration maintained on GitHub under the user ''robinostlund''. ''evcc'', the open-source EV charge controller used to align home charging with solar production, polled the VW backend periodically to read battery state.<ref name="evccrepo">{{Cite web |url=https://github.com/evcc-io/evcc |title=evcc-io/evcc (repository) |publisher=GitHub |access-date=2026-05-29}}</ref><ref name="evccdiscussion" />


== The API shutdown ==
== The API shutdown ==


On the afternoon of May 27, 2026, every third-party client targeting the Volkswagen Group cloud began failing simultaneously.<ref name="borncity" /><ref name="issue967">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet/issues/967 |title=[BUG] Login no more possible, Android App still works |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |date=2026-05-27 |access-date=2026-05-29}}</ref> Users reported authentication failures with credentials that had worked the prior day, while the official Volkswagen, Audi & MyŠkoda smartphone apps continued to authenticate normally.<ref name="issue967" /><ref name="issue969" /> The integration logs showed unauthorized, forbidden, & bad-request responses against the VW Group token endpoint.<ref name="evccdiscussion" />
On the afternoon of May 27, 2026, every third-party client targeting the Volkswagen Group cloud began failing simultaneously, while the official Volkswagen, Audi & MyŠkoda smartphone apps continued to authenticate normally.<ref name="borncity" /><ref name="issue967">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet/issues/967 |title=[BUG] Login no more possible, Android App still works |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |date=2026-05-27 |access-date=2026-05-29}}</ref><ref name="issue969" /> Integration logs showed unauthorized, forbidden & bad-request responses against the VW Group token endpoint.<ref name="evccdiscussion" />


Community analysis of the shipping VW-App build identified the change as a migration of the OIDC token endpoint from ''/login/v1/idk/token'' to ''/auth/v1/idk/oidc/token'', combined with a new requirement that the client prove via cryptographic ''attestation'' that the request originates from an official VW Group app.<ref name="evccdiscussion" /> Maintainers responded the same day by extracting the attestation parameters from the shipping Volkswagen Android app & restoring access through emulation; fixes shipped within hours as pull requests against ''evcc'' & the ''volkswagencarnet'' Python package.<ref name="evccdiscussion" /> The change therefore raised the engineering bar for community integrations rather than ending them outright, & continued access depends on maintainers tracking every future VW-App build.
Community analysis of the shipping VW-App build identified the change as a migration of the OIDC token endpoint from ''/login/v1/idk/token'' to ''/auth/v1/idk/oidc/token'', combined with a new requirement that the client prove via cryptographic ''attestation'' that the request originates from an official VW Group app.<ref name="evccdiscussion" /> Maintainers responded the same day by extracting the attestation parameters from the shipping Volkswagen Android app & restoring access through emulation; fixes shipped within hours as pull requests against ''evcc'' & the ''volkswagencarnet'' Python package.<ref name="evccdiscussion" /> The change raised the engineering bar for community integrations rather than ending them outright, & continued access depends on maintainers tracking every future VW-App build.
 
The first public confirmation came from owners filing bug reports against ''homeassistant-volkswagencarnet'' on the afternoon of the cutover, then from a separate issue titled ''"[BUG] VW has disabled access to API, so any services based on it no longer work"'' opened the same day.<ref name="issue967" /><ref name="issue969" />


=== Affected integrations & features ===
=== Affected integrations & features ===


The breakage affected every community-developed VW Group tool in active use, including:
The breakage hit every community-developed VW Group tool in active use:


* ''homeassistant-volkswagencarnet'' (Home Assistant, Robin Östlund)<ref name="issue967" /><ref name="issue969" />
* ''homeassistant-volkswagencarnet'' (Home Assistant, Robin Östlund)<ref name="issue967" /><ref name="issue969" />
Line 37: Line 33:
* ''homeassistant-myskoda'' (Škoda)<ref name="myskoda1112" />
* ''homeassistant-myskoda'' (Škoda)<ref name="myskoda1112" />


Functions that stopped working from the owner's smart-home side, even where the official app still showed them, included state-of-charge reporting, charging control, climate pre-conditioning, lock & unlock, & vehicle location.<ref name="borncity" /><ref name="mobiflip">{{Cite web |url=https://www.mobiflip.de/vw-nutzer-verlieren-ploetzlich-wichtige-smart-home-funktionen/ |title=VW-Nutzer verlieren plötzlich wichtige Smart-Home-Funktionen |last=Hesse |first=René |publisher=Mobiflip |date=2026-05-28 |access-date=2026-05-29}}</ref> Owners who had built automations to charge their EV only against solar surplus, the use case ''evcc'' was written for, lost it overnight: without a polled state-of-charge value from the car, the controller could not decide when to start or stop a charging session.<ref name="evccdiscussion" />
Functions that stopped working from the owner's smart-home side, even where the official app still showed them, included state-of-charge reporting, charging control, climate pre-conditioning, lock & unlock, & vehicle location.<ref name="borncity" /><ref name="mobiflip">{{Cite web |url=https://www.mobiflip.de/vw-nutzer-verlieren-ploetzlich-wichtige-smart-home-funktionen/ |title=VW-Nutzer verlieren plötzlich wichtige Smart-Home-Funktionen |last=Hesse |first=René |publisher=Mobiflip |date=2026-05-28 |access-date=2026-05-29}}</ref>


=== Home Assistant capabilities not available in the official app ===
=== Home Assistant capabilities not available in the official app ===


The community integrations were not a re-skin of the official Volkswagen app. They exposed each vehicle as a set of writable Home Assistant entities (switches, numbers, selects, device trackers, locks, climate controls) that any automation, dashboard, time-series database, voice assistant, or external script could read and command. The Volkswagen, MyAudi, MyŠkoda & Cupra apps are closed mobile clients with a fixed UI, no documented MQTT, REST, webhook, or local-network egress, no integration with rooftop solar or dynamic electricity tariffs, no calendar, geofence, or weather triggers, and no long-term data export. Many of the headline remote-control features in the official app sit behind the paid We Connect Plus subscription, priced on Volkswagen UK's own services page at £129 per year.<ref name="vwallservices">{{Cite web |url=https://www.volkswagen.co.uk/en/connected-services/vw-connect-id/all-services.html |title=VW Connect ID. - All Services |publisher=Volkswagen UK |access-date=2026-05-30}}</ref><ref name="id3plus">{{Cite web |url=https://www.id3forums.co.uk/viewtopic.php?t=3958 |title=WeConnect Plus app charges - free or not for older cars? |publisher=Volkswagen ID.3 Forum |date=2025-07-03 |access-date=2026-05-30}}</ref>
The community integrations were not a re-skin of the official Volkswagen app. They exposed each vehicle as writable Home Assistant entities (switches, numbers, selects, device trackers, locks, climate controls) that any automation, dashboard, time-series database, voice assistant or external script could read & command. The Volkswagen, MyAudi, MyŠkoda & Cupra apps are closed mobile clients with a fixed UI, & many of their headline remote-control features sit behind the paid We Connect Plus subscription priced on Volkswagen UK's services page at £129 per year.<ref name="vwallservices">{{Cite web |url=https://www.volkswagen.co.uk/en/connected-services/vw-connect-id/all-services.html |title=VW Connect ID. - All Services |publisher=Volkswagen UK |access-date=2026-05-30}}</ref><ref name="id3plus">{{Cite web |url=https://www.id3forums.co.uk/viewtopic.php?t=3958 |title=WeConnect Plus app charges - free or not for older cars? |publisher=Volkswagen ID.3 Forum |date=2025-07-03 |access-date=2026-05-30}}</ref>
 
{| class="wikitable"
{| class="wikitable"
! Capability !! Home Assistant integration / ''evcc'' !! Official Volkswagen / MyAudi / MyŠkoda / Cupra app
! Capability !! Home Assistant integration / ''evcc'' !! Official VW / MyAudi / MyŠkoda / Cupra app
|-
|-
| Charge only on rooftop solar surplus || ''evcc'' Solar mode starts charging ''"automatically as soon as the PV system delivers enough power"'' & continuously adjusts current ''"so that no power is drawn from the grid if possible"''<ref name="evccsolar">{{Cite web |url=https://docs.evcc.io/en/features/solar-charging/ |title=Solar Surplus Charging |publisher=evcc documentation |access-date=2026-05-30}}</ref> || No PV-surplus charging in the app. Volkswagen Group routes this use case to the separately purchased Elli Charger 2 hardware, whose product page states it ''"uses excess energy from solar power systems to directly charge the EV"''<ref name="ellisolar">{{Cite web |url=https://www.volkswagen-group.com/en/press-releases/volkswagen-group-brand-elli-launches-smart-charging-product-offensive-for-europe-18724 |title=Volkswagen Group brand Elli launches smart charging product offensive for Europe |publisher=Volkswagen Group |access-date=2026-05-30}}</ref>
| Charge only on rooftop solar surplus || '''Yes'''<ref name="evccsolar">{{Cite web |url=https://docs.evcc.io/en/features/solar-charging/ |title=Solar Surplus Charging |publisher=evcc documentation |access-date=2026-05-30}}</ref> || '''No'''<ref name="ellisolar">{{Cite web |url=https://www.volkswagen-group.com/en/press-releases/volkswagen-group-brand-elli-launches-smart-charging-product-offensive-for-europe-18724 |title=Volkswagen Group brand Elli launches smart charging product offensive for Europe |publisher=Volkswagen Group |access-date=2026-05-30}}</ref>
|-
|-
| Charge on a dynamic electricity tariff || ''evcc'' ships native integrations for Tibber, aWATTar, Octopus Energy, ENTSO-E, Energy Charts, Amber Electric, EPEX Predictor & Nordpool, & schedules charging into the cheapest hours<ref name="evcctariffs">{{Cite web |url=https://docs.evcc.io/en/tariffs/ |title=Tariffs & forecasts |publisher=evcc documentation |access-date=2026-05-30}}</ref> || No dynamic-tariff awareness in the app; VW's variable-price answer is again the Elli Charger 2 hardware, which ''"can automatically schedule the cheapest times to charge"''<ref name="ellisolar" />
| Charge on a dynamic electricity tariff || '''Yes'''<ref name="evcctariffs">{{Cite web |url=https://docs.evcc.io/en/tariffs/ |title=Tariffs & forecasts |publisher=evcc documentation |access-date=2026-05-30}}</ref> || '''No'''<ref name="ellisolar" />
|-
|-
| Force a cloud data refresh on demand || ''Force data refresh'' switch (<code>refresh_data</code>) wakes the cloud poll on command<ref name="vwdash">{{Cite web |url=https://github.com/robinostlund/volkswagencarnet/blob/master/volkswagencarnet/vw_dashboard.py |title=vw_dashboard.py source (RequestUpdate, Charging, DepartureTimer, BatteryTargetSOC, ScanInterval, ChargeMaxACAmpere, ElectricClimatisation, DoorLock, Position) |publisher=GitHub (robinostlund/volkswagencarnet) |access-date=2026-05-30}}</ref> || No user-facing refresh control listed on Volkswagen UK's services page<ref name="vwallservices" />
| Force a cloud data refresh on demand || '''Yes'''<ref name="vwdash">{{Cite web |url=https://github.com/robinostlund/volkswagencarnet/blob/master/volkswagencarnet/vw_dashboard.py |title=vw_dashboard.py source (RequestUpdate, Charging, DepartureTimer, BatteryTargetSOC, ScanInterval, ChargeMaxACAmpere, ElectricClimatisation, DoorLock, Position) |publisher=GitHub (robinostlund/volkswagencarnet) |access-date=2026-05-30}}</ref> || '''No'''<ref name="vwallservices" />
|-
|-
| Configurable polling interval per vehicle || Scan-interval <code>number</code> entity, default 5 minutes, configurable 0-60 minutes<ref name="harepo">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet |title=Volkswagen Connect for Home Assistant (README) |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |access-date=2026-05-30}}</ref><ref name="vwdash" /> || No user-controllable polling cadence listed on Volkswagen UK's services page<ref name="vwallservices" />
| Configurable polling interval per vehicle || '''Yes'''<ref name="harepo">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet |title=Volkswagen Connect for Home Assistant (README) |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |access-date=2026-05-30}}</ref> || '''No'''<ref name="vwallservices" />
|-
|-
| Read instantaneous charge power in kilowatts || Exposes charging power as a <code>sensor</code> with <code>POWER</code> device class<ref name="vwdash" /> || A user documenting a Home Assistant dashboard noted that charging power in kilowatts ''"at the moment it is not possible to obtain from the car infotainment"''<ref name="zanatta">{{Cite web |url=https://www.davidezanatta.com/blog/volkswagen-weconnect-id-in-home-assistant-and-custom-dashboard-for-id-3/?lang=en |title=Volkswagen WeConnect ID in Home Assistant and Custom Dashboard for ID.3 |last=Zanatta |first=Davide |access-date=2026-05-30}}</ref>
| Read instantaneous charge power in kilowatts || '''Yes'''<ref name="vwdash" /> || '''No'''<ref name="zanatta">{{Cite web |url=https://www.davidezanatta.com/blog/volkswagen-weconnect-id-in-home-assistant-and-custom-dashboard-for-id-3/?lang=en |title=Volkswagen WeConnect ID in Home Assistant and Custom Dashboard for ID.3 |last=Zanatta |first=Davide |access-date=2026-05-30}}</ref>
|-
|-
| Cap AC charging current in amperes || <code>select.charge_max_ac_ampere</code> writable to 5, 10, 13, 16 or 32 A<ref name="vwdash" /> || No user-selectable AC amperage cap listed on Volkswagen UK's services page<ref name="vwallservices" />
| Cap AC charging current in amperes || '''Yes'''<ref name="vwdash" /> || '''No'''<ref name="vwallservices" />
|-
|-
| Multiple departure timers with scriptable conditions || Three <code>switch.departure_timer{1..3}</code> entities, each settable via the <code>update_schedule</code> service with weekdays, start/end window, & per-timer charging & climatisation flags<ref name="haservices">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet/blob/master/custom_components/volkswagencarnet/services.yaml |title=services.yaml (update_schedule service) |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |access-date=2026-05-30}}</ref> || Scheduled charging exists only as in-app entries; no external automation hooks listed on Volkswagen UK's services page<ref name="vwallservices" />
| Multiple departure timers with scriptable conditions || '''Yes'''<ref name="haservices">{{Cite web |url=https://github.com/robinostlund/homeassistant-volkswagencarnet/blob/master/custom_components/volkswagencarnet/services.yaml |title=services.yaml (update_schedule service) |publisher=GitHub (robinostlund/homeassistant-volkswagencarnet) |access-date=2026-05-30}}</ref> || '''No'''<ref name="vwallservices" />
|-
|-
| Pre-condition cabin from weather, calendar or geofence || Documented Home Assistant automation triggers cabin pre-heat at 07:00 ''"when it's freezing outside"'' (outdoor temperature below 1 °C) via <code>switch.electric_climatisation</code><ref name="hacommunity">{{Cite web |url=https://community.home-assistant.io/t/custom-integration-volkswagen-weconnect-id-europe/380933 |title=Custom Integration: Volkswagen WeConnect ID (Europe) |publisher=Home Assistant Community |access-date=2026-05-30}}</ref><ref name="vwdash" /> || App supports clock-based departure timers only; no trigger on outdoor temperature, calendar event, geofence, or weather forecast listed on Volkswagen UK's services page<ref name="vwallservices" />
| Pre-condition cabin from weather, calendar or geofence || '''Yes'''<ref name="hacommunity">{{Cite web |url=https://community.home-assistant.io/t/custom-integration-volkswagen-weconnect-id-europe/380933 |title=Custom Integration: Volkswagen WeConnect ID (Europe) |publisher=Home Assistant Community |access-date=2026-05-30}}</ref> || '''No'''<ref name="vwallservices" />
|-
|-
| User-defined notifications on charge events || User automations send notifications such as ''"car is done charging"'' with current range, & alerts on charging-error state, via any Home Assistant notifier<ref name="hacommunity" /> || Push notifications are limited to the app's preset events; no user-defined predicates & no third-party notifier (Pushover, Telegram, ntfy) listed on Volkswagen UK's services page<ref name="vwallservices" />
| User-defined notifications on charge events || '''Yes'''<ref name="hacommunity" /> || '''No'''<ref name="vwallservices" />
|-
|-
| Multi-vehicle, multi-brand single dashboard || Home Assistant aggregates the Volkswagen alongside other brand integrations (Tesla, BMW, heat pumps, solar inverters); the integration ''"supports Volkswagen Connect vehicles such as the Passat, Golf, e-Golf, Tiguan, ID series, and more"'' as native devices<ref name="harepo" /> || Apps are brand-siloed: Volkswagen, MyAudi, MyŠkoda & Cupra each ship a separate mobile app, and Volkswagen UK's services page lists no cross-brand or multi-vehicle aggregation feature<ref name="vwallservices" />
| Multi-vehicle, multi-brand single dashboard || '''Yes'''<ref name="harepo" /> || '''No'''<ref name="vwallservices" />
|-
|-
| Long-term historisation of every reading || Home Assistant's built-in Recorder integration ''"constantly saves data"'' to a local SQL database for query, retention & export<ref name="harecorder">{{Cite web |url=https://www.home-assistant.io/integrations/recorder/ |title=Recorder |publisher=Home Assistant |access-date=2026-05-30}}</ref> || App shows recent trips & charging sessions in-app only; no CSV, JSON or database export documented on Volkswagen UK's services page<ref name="vwallservices" />
| Long-term historisation of every reading || '''Yes'''<ref name="harecorder">{{Cite web |url=https://www.home-assistant.io/integrations/recorder/ |title=Recorder |publisher=Home Assistant |access-date=2026-05-30}}</ref> || '''No'''<ref name="vwallservices" />
|-
|-
| Open egress over MQTT for external consumers || The companion ''WeConnect-mqtt'' library is ''"MQTT Client that publishes data from Volkswagen WeConnect"'', exposing vehicle data on MQTT topics that any subscriber can consume<ref name="wcmqtt">{{Cite web |url=https://github.com/tillsteinbach/WeConnect-mqtt |title=tillsteinbach/WeConnect-mqtt |publisher=GitHub |access-date=2026-05-30}}</ref> || No MQTT, REST, webhook or local-network interface listed on Volkswagen UK's services page<ref name="vwallservices" />
| Open egress over MQTT for external consumers || '''Yes'''<ref name="wcmqtt">{{Cite web |url=https://github.com/tillsteinbach/WeConnect-mqtt |title=tillsteinbach/WeConnect-mqtt |publisher=GitHub |access-date=2026-05-30}}</ref> || '''No'''<ref name="vwallservices" />
|-
|-
| Door lock & unlock as an automation primitive || <code>lock.door_locked</code> entity, gated by the owner's S-PIN; usable from any Home Assistant automation<ref name="vwdash" /><ref name="harepo" /> || App offers manual lock & unlock from the lock screen only; no scripting or conditional automation listed on Volkswagen UK's services page<ref name="vwallservices" />
| Door lock & unlock as an automation primitive || '''Yes'''<ref name="vwdash" /> || '''No'''<ref name="vwallservices" />
|-
|-
| Vehicle location as a Home Assistant <code>device_tracker</code> || <code>device_tracker.position</code> entity, usable in zones, geofences & presence detection<ref name="vwdash" /> || Location is visible in the app but no geofencing, presence, or webhook interface is documented on Volkswagen UK's services page<ref name="vwallservices" />
| Vehicle location as a Home Assistant device tracker || '''Yes'''<ref name="vwdash" /> || '''No'''<ref name="vwallservices" />
|-
|-
| Voice control through Apple HomeKit || All exposed entities are reachable through Home Assistant's voice-assistant bridges; an owner in the integration's community thread documented exposing the Volkswagen integration to HomeKit via a Home Assistant input boolean<ref name="hacommunity" /> || No Apple HomeKit, Amazon Alexa or Google Home skill for We Connect is listed on Volkswagen UK's services page; voice control is limited to in-car ''"Hello ID."''<ref name="vwweconnectstart">{{Cite web |url=https://www.volkswagen.co.uk/en/connected-services/vw-connect-id/we-connect-start.html |title=We Connect Start |publisher=Volkswagen UK |access-date=2026-05-30}}</ref><ref name="vwallservices" />
| Voice control through Apple HomeKit || '''Yes'''<ref name="hacommunity" /> || '''No'''<ref name="vwweconnectstart">{{Cite web |url=https://www.volkswagen.co.uk/en/connected-services/vw-connect-id/we-connect-start.html |title=We Connect Start |publisher=Volkswagen UK |access-date=2026-05-30}}</ref>
|-
|-
| Free, no-subscription remote charge & climate control || Runs against the owner's existing Volkswagen account at no recurring cost<ref name="harepo" /> || Volkswagen UK lists ''"Extend by 1 year (inc. VAT) £129"'' for We Connect Plus, following a trial of two to five years depending on model & build date<ref name="vwallservices" /><ref name="id3plus" />
| Free, no-subscription remote charge & climate control || '''Yes'''<ref name="harepo" /> || '''No'''<ref name="vwallservices" />
|}
|}


=== Volkswagen's response ===
=== Volkswagen's response ===


Volkswagen Group did not issue a press release about the change before the German tech press picked it up on May 28-29, 2026.<ref name="schmidt" /><ref name="mobiflip" />
Volkswagen Group issued no press release before the German tech press picked up the change on May 28-29, 2026.<ref name="schmidt" /><ref name="mobiflip" /> The official explanation surfaced on a private Škoda owners' Facebook group, posted by VW Group Info Services & reposted into the public GitHub trackers. It described the change as a ''"formal framework for third-party access to vehicle data"'' intended to ''"make sure these apps work reliably and your data stays protected,"'' & told owners:
 
The official explanation surfaced on a private Škoda owners' Facebook group, posted by VW Group Info Services & reposted by users into the public GitHub trackers. It described the change as a ''"formal framework for third-party access to vehicle data"'' intended to ''"make sure these apps work reliably and your data stays protected,"'' & told owners:


<blockquote>''"Apps without a formalised relationship with VW Group Info Services will no longer be able to access vehicle data. If you use a third-party app and you are not sure whether it is integrated, the best step is to contact the provider directly and ask them to complete the attestation process with VW Group Info Services."''</blockquote><ref name="myskoda1112" />
<blockquote>''"Apps without a formalised relationship with VW Group Info Services will no longer be able to access vehicle data. If you use a third-party app and you are not sure whether it is integrated, the best step is to contact the provider directly and ask them to complete the attestation process with VW Group Info Services."''</blockquote><ref name="myskoda1112" />
Line 90: Line 85:
== Consumer response ==
== Consumer response ==


The ''homeassistant-volkswagencarnet'' tracker accumulated bug reports from European owners, all reporting identical authentication failures with credentials that still worked in the official app.<ref name="issue967" /><ref name="issue969" />
The ''homeassistant-volkswagencarnet'' tracker accumulated bug reports from European owners, all reporting identical authentication failures with credentials that still worked in the official app.<ref name="issue967" /><ref name="issue969" /> The ''evcc'' maintainers opened a dedicated discussion thread & asked participants to keep arguments about suing Volkswagen in a separate thread so the technical work could proceed; owners across the GitHub threads repeatedly invoked the [[EU Data Act]] as the legal basis on which the lockout should be challenged.<ref name="evccdiscussion" />
 
The ''evcc'' maintainers opened a dedicated discussion thread that drew sustained engagement, & explicitly asked participants to keep arguments about suing Volkswagen in a separate thread so the technical work could proceed.<ref name="evccdiscussion" /> Owners across the GitHub threads repeatedly invoked the [[EU Data Act]] as the legal basis on which the lockout should be challenged.<ref name="evccdiscussion" />


Some owners canvassed switching brands. A reader quoted by ''Mobiflip'' wrote that if Volkswagen could not offer a workable interface ''"wie es BMW gemacht hat"'' (''"like BMW has done"''), ''"wird es halt kein VW mehr"'' (''"then it just won't be a VW anymore"'').<ref name="mobiflip" />
A reader quoted by ''Mobiflip'' wrote that if Volkswagen could not offer a workable interface ''"wie es BMW gemacht hat"'' (''"like BMW has done"''), ''"wird es halt kein VW mehr"'' (''"then it just won't be a VW anymore"'').<ref name="mobiflip" />


== Regulatory context ==
== Regulatory context ==


The [[EU Data Act]] (Regulation (EU) 2023/2854) entered into force on January 11, 2024.<ref name="hunton">{{Cite web |url=https://www.hunton.com/privacy-and-cybersecurity-law-blog/key-provisions-of-the-eu-data-act-take-effect |title=Key Provisions of the EU Data Act Take Effect |publisher=Hunton Andrews Kurth |access-date=2026-05-29}}</ref> The majority of its provisions began to apply on September 12, 2025, & design-by-default obligations on connected products & related services offered in the EU follow after September 12, 2026.<ref name="hunton" /><ref name="latham">{{Cite web |url=https://www.lw.com/en/insights/eu-data-act-what-businesses-need-to-know |title=EU Data Act: What Businesses Need to Know |publisher=Latham & Watkins |access-date=2026-05-29}}</ref> Under Articles 4 & 5 of the regulation, a data holder must, when the user requests it, make readily available data accessible to a designated third party in a structured, commonly used & machine-readable format.<ref name="latham" /><ref name="hunton" />
The [[EU Data Act]] (Regulation (EU) 2023/2854) entered into force on January 11, 2024.<ref name="hunton">{{Cite web |url=https://www.hunton.com/privacy-and-cybersecurity-law-blog/key-provisions-of-the-eu-data-act-take-effect |title=Key Provisions of the EU Data Act Take Effect |publisher=Hunton Andrews Kurth |access-date=2026-05-29}}</ref> The majority of its provisions began to apply on September 12, 2025, & design-by-default obligations on connected products & related services offered in the EU follow after September 12, 2026.<ref name="hunton" /><ref name="latham">{{Cite web |url=https://www.lw.com/en/insights/eu-data-act-what-businesses-need-to-know |title=EU Data Act: What Businesses Need to Know |publisher=Latham & Watkins |access-date=2026-05-29}}</ref> Under Articles 4 & 5, a data holder must, when the user requests it, make readily available data accessible to a designated third party in a structured, commonly used & machine-readable format.<ref name="latham" /><ref name="hunton" />


Within hours of the cutover, owners on the GitHub trackers argued that a Cariad-issued partner-attestation requirement that excludes free-software clients cannot be reconciled with that Article 4 / Article 5 obligation.<ref name="evccdiscussion" /> No regulator had opened a public proceeding against Volkswagen Group over the API shutdown as of late May 2026.
Within hours of the cutover, owners on the GitHub trackers argued that a Cariad-issued partner-attestation requirement that excludes free-software clients cannot be reconciled with that Article 4 / Article 5 obligation.<ref name="evccdiscussion" />


== Pattern of automaker API lockouts ==
== Pattern of automaker API lockouts ==
Line 111: Line 104:
* General Motors announced the removal of [[Apple CarPlay]] & Android Auto from future EVs.<ref name="pickup" />
* General Motors announced the removal of [[Apple CarPlay]] & Android Auto from future EVs.<ref name="pickup" />


In the United States the legal frame around owner access to vehicle data has tilted toward owners. On February 11, 2025, U.S. District Judge Denise Casper dismissed the [[Alliance for Automotive Innovation]]'s suit challenging the Massachusetts Data Access Law, which was approved by Massachusetts voters in 2020.<ref name="autocare">{{Cite web |url=https://www.autocare.org/news/latest-news/details/2025/02/11/auto-care-association-applauds-verdict-in-years-long-massachusetts-right-to-repair-battle |title=Auto Care Association Applauds Verdict in Years-Long Massachusetts Right to Repair Battle |publisher=Auto Care Association |date=2025-02-11 |access-date=2026-05-29}}</ref><ref name="wbur">{{Cite web |url=https://www.wbur.org/news/2025/02/12/massachusetts-right-to-repair-carr-law-challenges-dismissed |title=Massachusetts right-to-repair law upheld as judge dismisses automaker challenge |publisher=WBUR |date=2025-02-12 |access-date=2026-05-29}}</ref>
In the United States, on February 11, 2025, U.S. District Judge Denise Casper dismissed the [[Alliance for Automotive Innovation]]'s suit challenging the Massachusetts Data Access Law, which Massachusetts voters approved in 2020.<ref name="autocare">{{Cite web |url=https://www.autocare.org/news/latest-news/details/2025/02/11/auto-care-association-applauds-verdict-in-years-long-massachusetts-right-to-repair-battle |title=Auto Care Association Applauds Verdict in Years-Long Massachusetts Right to Repair Battle |publisher=Auto Care Association |date=2025-02-11 |access-date=2026-05-29}}</ref><ref name="wbur">{{Cite web |url=https://www.wbur.org/news/2025/02/12/massachusetts-right-to-repair-carr-law-challenges-dismissed |title=Massachusetts right-to-repair law upheld as judge dismisses automaker challenge |publisher=WBUR |date=2025-02-12 |access-date=2026-05-29}}</ref>


== See also ==
== See also ==

Revision as of 19:33, 30 May 2026

On May 27, 2026, Volkswagen Group silently disabled the authentication flow that third-party software had used for years to read & control its vehicles, breaking the widely deployed Home Assistant integration homeassistant-volkswagencarnet & the open-source EV charge controller evcc.[1][2] The cutover extended across the Volkswagen, Audi, Škoda & Cupra brands.[3][4] The new token endpoint requires a cryptographic attestation tying each request to an official VW Group app, locking out community clients that had authenticated with stored owner credentials alone.[2][4] Volkswagen published no press release; the official explanation surfaced on a private Škoda owners' Facebook group, telling owners that apps lacking a formalised relationship with VW Group Info Services would no longer access vehicle data.[3]

Background

The We Connect service is the cloud backend for Volkswagen Group's connected-vehicle features: state-of-charge reporting, remote charge control, climate pre-conditioning, lock & unlock, departure timers, & location. The community homeassistant-volkswagencarnet integration that exposed those features to home automation began with the Passat, Golf, e-Golf & Tiguan, & later expanded to the ID series.[5] evcc, the open-source EV charge controller used to align home charging with solar production, polled the VW backend periodically to read battery state.[6][4]

Volkswagen already monetises consumer access to those features, & Schmidtisblog reported that the company "verweist bereits auf kostenpflichtige Business-Schnittstellen für Firmenkunden" ("already points to paid business interfaces for corporate customers").[7]

The API shutdown

On the afternoon of May 27, 2026, every third-party client targeting the Volkswagen Group cloud began failing simultaneously, while the official Volkswagen, Audi & MyŠkoda smartphone apps continued to authenticate normally.[1][8][2] Integration logs showed unauthorized, forbidden & bad-request responses against the VW Group token endpoint.[4]

Community analysis of the shipping VW-App build identified the change as a migration of the OIDC token endpoint from /login/v1/idk/token to /auth/v1/idk/oidc/token, combined with a new requirement that the client prove via cryptographic attestation that the request originates from an official VW Group app.[4] Maintainers responded the same day by extracting the attestation parameters from the shipping Volkswagen Android app & restoring access through emulation; fixes shipped within hours as pull requests against evcc & the volkswagencarnet Python package.[4] The change raised the engineering bar for community integrations rather than ending them outright, & continued access depends on maintainers tracking every future VW-App build.

Affected integrations & features

The breakage hit every community-developed VW Group tool in active use:

  • homeassistant-volkswagencarnet (Home Assistant, Robin Östlund)[8][2]
  • evcc solar-aware EV charge controller[4]
  • homeassistant-myskoda (Škoda)[3]

Functions that stopped working from the owner's smart-home side, even where the official app still showed them, included state-of-charge reporting, charging control, climate pre-conditioning, lock & unlock, & vehicle location.[1][9]

Home Assistant capabilities not available in the official app

The community integrations were not a re-skin of the official Volkswagen app. They exposed each vehicle as writable Home Assistant entities (switches, numbers, selects, device trackers, locks, climate controls) that any automation, dashboard, time-series database, voice assistant or external script could read & command. The Volkswagen, MyAudi, MyŠkoda & Cupra apps are closed mobile clients with a fixed UI, & many of their headline remote-control features sit behind the paid We Connect Plus subscription priced on Volkswagen UK's services page at £129 per year.[10][11]

Capability Home Assistant integration / evcc Official VW / MyAudi / MyŠkoda / Cupra app
Charge only on rooftop solar surplus Yes[12] No[13]
Charge on a dynamic electricity tariff Yes[14] No[13]
Force a cloud data refresh on demand Yes[15] No[10]
Configurable polling interval per vehicle Yes[16] No[10]
Read instantaneous charge power in kilowatts Yes[15] No[17]
Cap AC charging current in amperes Yes[15] No[10]
Multiple departure timers with scriptable conditions Yes[18] No[10]
Pre-condition cabin from weather, calendar or geofence Yes[19] No[10]
User-defined notifications on charge events Yes[19] No[10]
Multi-vehicle, multi-brand single dashboard Yes[16] No[10]
Long-term historisation of every reading Yes[20] No[10]
Open egress over MQTT for external consumers Yes[21] No[10]
Door lock & unlock as an automation primitive Yes[15] No[10]
Vehicle location as a Home Assistant device tracker Yes[15] No[10]
Voice control through Apple HomeKit Yes[19] No[22]
Free, no-subscription remote charge & climate control Yes[16] No[10]

Volkswagen's response

Volkswagen Group issued no press release before the German tech press picked up the change on May 28-29, 2026.[7][9] The official explanation surfaced on a private Škoda owners' Facebook group, posted by VW Group Info Services & reposted into the public GitHub trackers. It described the change as a "formal framework for third-party access to vehicle data" intended to "make sure these apps work reliably and your data stays protected," & told owners:

"Apps without a formalised relationship with VW Group Info Services will no longer be able to access vehicle data. If you use a third-party app and you are not sure whether it is integrated, the best step is to contact the provider directly and ask them to complete the attestation process with VW Group Info Services."

[3]

The attestation programme is a business-to-business product. In September 2024 VW Group Info Services announced an integration with telematics provider Geotab to surface Volkswagen Group vehicle data for commercial fleet customers.[23] An owner running homeassistant-volkswagencarnet on a home server is not the target customer.

Consumer response

The homeassistant-volkswagencarnet tracker accumulated bug reports from European owners, all reporting identical authentication failures with credentials that still worked in the official app.[8][2] The evcc maintainers opened a dedicated discussion thread & asked participants to keep arguments about suing Volkswagen in a separate thread so the technical work could proceed; owners across the GitHub threads repeatedly invoked the EU Data Act as the legal basis on which the lockout should be challenged.[4]

A reader quoted by Mobiflip wrote that if Volkswagen could not offer a workable interface "wie es BMW gemacht hat" ("like BMW has done"), "wird es halt kein VW mehr" ("then it just won't be a VW anymore").[9]

Regulatory context

The EU Data Act (Regulation (EU) 2023/2854) entered into force on January 11, 2024.[24] The majority of its provisions began to apply on September 12, 2025, & design-by-default obligations on connected products & related services offered in the EU follow after September 12, 2026.[24][25] Under Articles 4 & 5, a data holder must, when the user requests it, make readily available data accessible to a designated third party in a structured, commonly used & machine-readable format.[25][24]

Within hours of the cutover, owners on the GitHub trackers argued that a Cariad-issued partner-attestation requirement that excludes free-software clients cannot be reconciled with that Article 4 / Article 5 obligation.[4]

Pattern of automaker API lockouts

Mazda, Toyota, Stellantis & General Motors have each restricted or monetised owner access to vehicle data in the preceding three years.

  • Mazda sent a Digital Millennium Copyright Act takedown to GitHub in 2023, forcing the removal of the open-source libraries used by Home Assistant.[26]
  • Toyota moved remote start, remote climate & other Remote Connect functions behind a paid subscription that begins after the included trial period.[27]
  • Stellantis charges $9.99 per month or $109.89 per year for connected navigation across its brands.[27]
  • General Motors announced the removal of Apple CarPlay & Android Auto from future EVs.[27]

In the United States, on February 11, 2025, U.S. District Judge Denise Casper dismissed the Alliance for Automotive Innovation's suit challenging the Massachusetts Data Access Law, which Massachusetts voters approved in 2020.[28][29]

See also

References

  1. 1.0 1.1 1.2 "VW und Audi sperren API-Schnittstelle; "Smart-Home-Blackout" seit 27.05.2026 - Teil 1". Borncity. 2026-05-29. Retrieved 2026-05-29.
  2. 2.0 2.1 2.2 2.3 2.4 "[BUG] VW has disabled access to API, so any services based on it no longer work". GitHub (robinostlund/homeassistant-volkswagencarnet). 2026-05-27. Retrieved 2026-05-29.
  3. 3.0 3.1 3.2 3.3 "API access change - VW Group third-party framework". GitHub (skodaconnect/homeassistant-myskoda). 2026-05-26. Retrieved 2026-05-29.
  4. 4.0 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 "VW lock API requests soon and allow only registered Apps #30236". GitHub (evcc-io/evcc). 2026-05-27. Retrieved 2026-05-29.
  5. "robinostlund/homeassistant-volkswagencarnet (repository description)". GitHub. Retrieved 2026-05-29.
  6. "evcc-io/evcc (repository)". GitHub. Retrieved 2026-05-29.
  7. 7.0 7.1 Schmidt, Jörn (2026-05-28). "Heimlicher Stecker gezogen - Warum VW-Fahrer gerade ihr Smart Home verlieren". Schmidtis Blog. Retrieved 2026-05-29.
  8. 8.0 8.1 8.2 "[BUG] Login no more possible, Android App still works". GitHub (robinostlund/homeassistant-volkswagencarnet). 2026-05-27. Retrieved 2026-05-29.
  9. 9.0 9.1 9.2 Hesse, René (2026-05-28). "VW-Nutzer verlieren plötzlich wichtige Smart-Home-Funktionen". Mobiflip. Retrieved 2026-05-29.
  10. 10.00 10.01 10.02 10.03 10.04 10.05 10.06 10.07 10.08 10.09 10.10 10.11 10.12 "VW Connect ID. - All Services". Volkswagen UK. Retrieved 2026-05-30.
  11. "WeConnect Plus app charges - free or not for older cars?". Volkswagen ID.3 Forum. 2025-07-03. Retrieved 2026-05-30.
  12. "Solar Surplus Charging". evcc documentation. Retrieved 2026-05-30.
  13. 13.0 13.1 "Volkswagen Group brand Elli launches smart charging product offensive for Europe". Volkswagen Group. Retrieved 2026-05-30.
  14. "Tariffs & forecasts". evcc documentation. Retrieved 2026-05-30.
  15. 15.0 15.1 15.2 15.3 15.4 "vw_dashboard.py source (RequestUpdate, Charging, DepartureTimer, BatteryTargetSOC, ScanInterval, ChargeMaxACAmpere, ElectricClimatisation, DoorLock, Position)". GitHub (robinostlund/volkswagencarnet). Retrieved 2026-05-30.
  16. 16.0 16.1 16.2 "Volkswagen Connect for Home Assistant (README)". GitHub (robinostlund/homeassistant-volkswagencarnet). Retrieved 2026-05-30.
  17. Zanatta, Davide. "Volkswagen WeConnect ID in Home Assistant and Custom Dashboard for ID.3". Retrieved 2026-05-30.
  18. "services.yaml (update_schedule service)". GitHub (robinostlund/homeassistant-volkswagencarnet). Retrieved 2026-05-30.
  19. 19.0 19.1 19.2 "Custom Integration: Volkswagen WeConnect ID (Europe)". Home Assistant Community. Retrieved 2026-05-30.
  20. "Recorder". Home Assistant. Retrieved 2026-05-30.
  21. "tillsteinbach/WeConnect-mqtt". GitHub. Retrieved 2026-05-30.
  22. "We Connect Start". Volkswagen UK. Retrieved 2026-05-30.
  23. "OEM telematics integration is maximizing EV fleet efficiency and ROI". Electrek. 2025-12-20. Retrieved 2026-05-29.
  24. 24.0 24.1 24.2 "Key Provisions of the EU Data Act Take Effect". Hunton Andrews Kurth. Retrieved 2026-05-29.
  25. 25.0 25.1 "EU Data Act: What Businesses Need to Know". Latham & Watkins. Retrieved 2026-05-29.
  26. "Mazda Slaps Developer With Cease-and-Desist for DIY Smart Home Integration". The Drive. 2023-10-20. Retrieved 2026-05-29.
  27. 27.0 27.1 27.2 "Buyer Beware: Subscription Fees Are Hidden In Your New Car". Pickup Truck Talk. July 2024. Retrieved 2026-05-29.
  28. "Auto Care Association Applauds Verdict in Years-Long Massachusetts Right to Repair Battle". Auto Care Association. 2025-02-11. Retrieved 2026-05-29.
  29. "Massachusetts right-to-repair law upheld as judge dismisses automaker challenge". WBUR. 2025-02-12. Retrieved 2026-05-29.