Tado authentication

ErikDB · September 5, 2025, 9:44am

Is there a dedicated topic for the tado binding?

Anyway, I (and undoubtedly many others) received this e-mail:

Hello Erik,

We have an important update for users of our REST API, which—while never officially supported for third parties—we’ve historically left open and unrestricted. We’ve always believed in fair use, and we intend to continue supporting that principle.

The API is commonly used by third-party and open-source platforms (e.g., Home Assistant), as well as by users running their own custom scripts. Nevertheless, a small fraction of very frequent API users are currently responsible for a disproportionately high share of our server expenses.

To ensure long-term stability and to avoid restricting access for everyone, we will begin introducing daily usage limits for API calls.

Your daily quota will depend on whether you have an active tado° Auto-Assist subscription:

Without Auto-Assist: 100 requests/day
A small daily quota, which should still support basic use cases that are not available via tado’s local APIs: HomeKit for V3/V3+ devices or Matter for tado° X devices. We have updated the documentation on how to access the REST API to reflect these changes.

With Auto-Assist: 20.000 requests/day
This should cover even more demanding use cases, and the subscription fees enable us to offset the increased costs associated with additional server calls.

We’ve shared these changes very early in our consideration process with Home Assistant, the largest open-source software using the unofficial tado° REST API, asking them to adapt their integration to rely more on tado’s local APIs. We understand this creates challenges for community projects. Therefore, we will slowly ramp down limits over the next few months for a smooth transition.

Our goal is to strike a fair balance, ensuring that responsible use remains possible while keeping infrastructure costs under control.

Thank you for your understanding.

Warm regards,

Your tado° Team

Sounds like a sophism…

There’s talk of a local API, but since OAuth was introduced lately, I wonder which API the binding uses?