Jump to content

Volkswagen Carnet API shutdown

From Consumer Rights Wiki
Revision as of 19:33, 30 May 2026 by Louis (talk | contribs) (simplified the capability table to yes/no columns and tightened the prose throughout, was too rambly)

On May 27, 2026, Volkswagen Group silently disabled the authentication flow that third-party software had used for years to read & control its vehicles, breaking the widely deployed Home Assistant integration homeassistant-volkswagencarnet & the open-source EV charge controller evcc.[1][2] The cutover extended across the Volkswagen, Audi, Škoda & Cupra brands.[3][4] The new token endpoint requires a cryptographic attestation tying each request to an official VW Group app, locking out community clients that had authenticated with stored owner credentials alone.[2][4] Volkswagen published no press release; the official explanation surfaced on a private Škoda owners' Facebook group, telling owners that apps lacking a formalised relationship with VW Group Info Services would no longer access vehicle data.[3]

Background

The We Connect service is the cloud backend for Volkswagen Group's connected-vehicle features: state-of-charge reporting, remote charge control, climate pre-conditioning, lock & unlock, departure timers, & location. The community homeassistant-volkswagencarnet integration that exposed those features to home automation began with the Passat, Golf, e-Golf & Tiguan, & later expanded to the ID series.[5] evcc, the open-source EV charge controller used to align home charging with solar production, polled the VW backend periodically to read battery state.[6][4]

Volkswagen already monetises consumer access to those features, & Schmidtisblog reported that the company "verweist bereits auf kostenpflichtige Business-Schnittstellen für Firmenkunden" ("already points to paid business interfaces for corporate customers").[7]

The API shutdown

On the afternoon of May 27, 2026, every third-party client targeting the Volkswagen Group cloud began failing simultaneously, while the official Volkswagen, Audi & MyŠkoda smartphone apps continued to authenticate normally.[1][8][2] Integration logs showed unauthorized, forbidden & bad-request responses against the VW Group token endpoint.[4]

Community analysis of the shipping VW-App build identified the change as a migration of the OIDC token endpoint from /login/v1/idk/token to /auth/v1/idk/oidc/token, combined with a new requirement that the client prove via cryptographic attestation that the request originates from an official VW Group app.[4] Maintainers responded the same day by extracting the attestation parameters from the shipping Volkswagen Android app & restoring access through emulation; fixes shipped within hours as pull requests against evcc & the volkswagencarnet Python package.[4] The change raised the engineering bar for community integrations rather than ending them outright, & continued access depends on maintainers tracking every future VW-App build.

Affected integrations & features

The breakage hit every community-developed VW Group tool in active use:

  • homeassistant-volkswagencarnet (Home Assistant, Robin Östlund)[8][2]
  • evcc solar-aware EV charge controller[4]
  • homeassistant-myskoda (Škoda)[3]

Functions that stopped working from the owner's smart-home side, even where the official app still showed them, included state-of-charge reporting, charging control, climate pre-conditioning, lock & unlock, & vehicle location.[1][9]

Home Assistant capabilities not available in the official app

The community integrations were not a re-skin of the official Volkswagen app. They exposed each vehicle as writable Home Assistant entities (switches, numbers, selects, device trackers, locks, climate controls) that any automation, dashboard, time-series database, voice assistant or external script could read & command. The Volkswagen, MyAudi, MyŠkoda & Cupra apps are closed mobile clients with a fixed UI, & many of their headline remote-control features sit behind the paid We Connect Plus subscription priced on Volkswagen UK's services page at £129 per year.[10][11]

Capability Home Assistant integration / evcc Official VW / MyAudi / MyŠkoda / Cupra app
Charge only on rooftop solar surplus Yes[12] No[13]
Charge on a dynamic electricity tariff Yes[14] No[13]
Force a cloud data refresh on demand Yes[15] No[10]
Configurable polling interval per vehicle Yes[16] No[10]
Read instantaneous charge power in kilowatts Yes[15] No[17]
Cap AC charging current in amperes Yes[15] No[10]
Multiple departure timers with scriptable conditions Yes[18] No[10]
Pre-condition cabin from weather, calendar or geofence Yes[19] No[10]
User-defined notifications on charge events Yes[19] No[10]
Multi-vehicle, multi-brand single dashboard Yes[16] No[10]
Long-term historisation of every reading Yes[20] No[10]
Open egress over MQTT for external consumers Yes[21] No[10]
Door lock & unlock as an automation primitive Yes[15] No[10]
Vehicle location as a Home Assistant device tracker Yes[15] No[10]
Voice control through Apple HomeKit Yes[19] No[22]
Free, no-subscription remote charge & climate control Yes[16] No[10]

Volkswagen's response

Volkswagen Group issued no press release before the German tech press picked up the change on May 28-29, 2026.[7][9] The official explanation surfaced on a private Škoda owners' Facebook group, posted by VW Group Info Services & reposted into the public GitHub trackers. It described the change as a "formal framework for third-party access to vehicle data" intended to "make sure these apps work reliably and your data stays protected," & told owners:

"Apps without a formalised relationship with VW Group Info Services will no longer be able to access vehicle data. If you use a third-party app and you are not sure whether it is integrated, the best step is to contact the provider directly and ask them to complete the attestation process with VW Group Info Services."

[3]

The attestation programme is a business-to-business product. In September 2024 VW Group Info Services announced an integration with telematics provider Geotab to surface Volkswagen Group vehicle data for commercial fleet customers.[23] An owner running homeassistant-volkswagencarnet on a home server is not the target customer.

Consumer response

The homeassistant-volkswagencarnet tracker accumulated bug reports from European owners, all reporting identical authentication failures with credentials that still worked in the official app.[8][2] The evcc maintainers opened a dedicated discussion thread & asked participants to keep arguments about suing Volkswagen in a separate thread so the technical work could proceed; owners across the GitHub threads repeatedly invoked the EU Data Act as the legal basis on which the lockout should be challenged.[4]

A reader quoted by Mobiflip wrote that if Volkswagen could not offer a workable interface "wie es BMW gemacht hat" ("like BMW has done"), "wird es halt kein VW mehr" ("then it just won't be a VW anymore").[9]

Regulatory context

The EU Data Act (Regulation (EU) 2023/2854) entered into force on January 11, 2024.[24] The majority of its provisions began to apply on September 12, 2025, & design-by-default obligations on connected products & related services offered in the EU follow after September 12, 2026.[24][25] Under Articles 4 & 5, a data holder must, when the user requests it, make readily available data accessible to a designated third party in a structured, commonly used & machine-readable format.[25][24]

Within hours of the cutover, owners on the GitHub trackers argued that a Cariad-issued partner-attestation requirement that excludes free-software clients cannot be reconciled with that Article 4 / Article 5 obligation.[4]

Pattern of automaker API lockouts

Mazda, Toyota, Stellantis & General Motors have each restricted or monetised owner access to vehicle data in the preceding three years.

  • Mazda sent a Digital Millennium Copyright Act takedown to GitHub in 2023, forcing the removal of the open-source libraries used by Home Assistant.[26]
  • Toyota moved remote start, remote climate & other Remote Connect functions behind a paid subscription that begins after the included trial period.[27]
  • Stellantis charges $9.99 per month or $109.89 per year for connected navigation across its brands.[27]
  • General Motors announced the removal of Apple CarPlay & Android Auto from future EVs.[27]

In the United States, on February 11, 2025, U.S. District Judge Denise Casper dismissed the Alliance for Automotive Innovation's suit challenging the Massachusetts Data Access Law, which Massachusetts voters approved in 2020.[28][29]

See also

References

  1. ↑ 1.0 1.1 1.2 "VW und Audi sperren API-Schnittstelle; "Smart-Home-Blackout" seit 27.05.2026 - Teil 1". Borncity. 2026-05-29. Retrieved 2026-05-29.
  2. ↑ 2.0 2.1 2.2 2.3 2.4 "[BUG] VW has disabled access to API, so any services based on it no longer work". GitHub (robinostlund/homeassistant-volkswagencarnet). 2026-05-27. Retrieved 2026-05-29.
  3. ↑ 3.0 3.1 3.2 3.3 "API access change - VW Group third-party framework". GitHub (skodaconnect/homeassistant-myskoda). 2026-05-26. Retrieved 2026-05-29.
  4. ↑ 4.0 4.1 4.2 4.3 4.4 4.5 4.6 4.7 4.8 "VW lock API requests soon and allow only registered Apps #30236". GitHub (evcc-io/evcc). 2026-05-27. Retrieved 2026-05-29.
  5. ↑ "robinostlund/homeassistant-volkswagencarnet (repository description)". GitHub. Retrieved 2026-05-29.
  6. ↑ "evcc-io/evcc (repository)". GitHub. Retrieved 2026-05-29.
  7. ↑ 7.0 7.1 Schmidt, Jörn (2026-05-28). "Heimlicher Stecker gezogen - Warum VW-Fahrer gerade ihr Smart Home verlieren". Schmidtis Blog. Retrieved 2026-05-29.
  8. ↑ 8.0 8.1 8.2 "[BUG] Login no more possible, Android App still works". GitHub (robinostlund/homeassistant-volkswagencarnet). 2026-05-27. Retrieved 2026-05-29.
  9. ↑ 9.0 9.1 9.2 Hesse, René (2026-05-28). "VW-Nutzer verlieren plötzlich wichtige Smart-Home-Funktionen". Mobiflip. Retrieved 2026-05-29.
  10. ↑ 10.00 10.01 10.02 10.03 10.04 10.05 10.06 10.07 10.08 10.09 10.10 10.11 10.12 "VW Connect ID. - All Services". Volkswagen UK. Retrieved 2026-05-30.
  11. ↑ "WeConnect Plus app charges - free or not for older cars?". Volkswagen ID.3 Forum. 2025-07-03. Retrieved 2026-05-30.
  12. ↑ "Solar Surplus Charging". evcc documentation. Retrieved 2026-05-30.
  13. ↑ 13.0 13.1 "Volkswagen Group brand Elli launches smart charging product offensive for Europe". Volkswagen Group. Retrieved 2026-05-30.
  14. ↑ "Tariffs & forecasts". evcc documentation. Retrieved 2026-05-30.
  15. ↑ 15.0 15.1 15.2 15.3 15.4 "vw_dashboard.py source (RequestUpdate, Charging, DepartureTimer, BatteryTargetSOC, ScanInterval, ChargeMaxACAmpere, ElectricClimatisation, DoorLock, Position)". GitHub (robinostlund/volkswagencarnet). Retrieved 2026-05-30.
  16. ↑ 16.0 16.1 16.2 "Volkswagen Connect for Home Assistant (README)". GitHub (robinostlund/homeassistant-volkswagencarnet). Retrieved 2026-05-30.
  17. ↑ Zanatta, Davide. "Volkswagen WeConnect ID in Home Assistant and Custom Dashboard for ID.3". Retrieved 2026-05-30.
  18. ↑ "services.yaml (update_schedule service)". GitHub (robinostlund/homeassistant-volkswagencarnet). Retrieved 2026-05-30.
  19. ↑ 19.0 19.1 19.2 "Custom Integration: Volkswagen WeConnect ID (Europe)". Home Assistant Community. Retrieved 2026-05-30.
  20. ↑ "Recorder". Home Assistant. Retrieved 2026-05-30.
  21. ↑ "tillsteinbach/WeConnect-mqtt". GitHub. Retrieved 2026-05-30.
  22. ↑ "We Connect Start". Volkswagen UK. Retrieved 2026-05-30.
  23. ↑ "OEM telematics integration is maximizing EV fleet efficiency and ROI". Electrek. 2025-12-20. Retrieved 2026-05-29.
  24. ↑ 24.0 24.1 24.2 "Key Provisions of the EU Data Act Take Effect". Hunton Andrews Kurth. Retrieved 2026-05-29.
  25. ↑ 25.0 25.1 "EU Data Act: What Businesses Need to Know". Latham & Watkins. Retrieved 2026-05-29.
  26. ↑ "Mazda Slaps Developer With Cease-and-Desist for DIY Smart Home Integration". The Drive. 2023-10-20. Retrieved 2026-05-29.
  27. ↑ 27.0 27.1 27.2 "Buyer Beware: Subscription Fees Are Hidden In Your New Car". Pickup Truck Talk. July 2024. Retrieved 2026-05-29.
  28. ↑ "Auto Care Association Applauds Verdict in Years-Long Massachusetts Right to Repair Battle". Auto Care Association. 2025-02-11. Retrieved 2026-05-29.
  29. ↑ "Massachusetts right-to-repair law upheld as judge dismisses automaker challenge". WBUR. 2025-02-12. Retrieved 2026-05-29.
Retrieved from "https://consumerrights.wiki/index.php?title=Volkswagen_Carnet_API_shutdown&oldid=55243"