Volkswagen blocks Home Assistant by requiring client assertion

TEXT START: [BUG] Login no more possible, Android App still works #967

The Dissection

Volkswagen has deployed client assertion authentication — a cryptographic requirement that only VW-issued client credentials can successfully authenticate. The Android app still works because it carries the official client certificate. The Home Assistant integration cannot forge that certificate. Login is now blocked.

This is not a bug. This is deliberate API lockdown.

The Core Fallacy

The bug reporter frames this as a regression — something broken that should be fixed. This misunderstands what's happening. VW changed the locks. The integration was always operating on borrowed access — reverse-engineered credentials and scraped endpoints. VW has now revoked that access with cryptographic finality.

The assumption baked into the original integration — that the car's APIs would remain accessible to anyone with a subscription and a login form — was always a temporary privilege masquerading as infrastructure. It depended on VW not caring enough to close it. They now care.

The Hidden Mechanics

VW is running a classic OEM gatekeeping strategy. The sequence is predictable:

1. Opening Phase — Lightweight APIs, undocumented endpoints, permissive auth flows. Goal: seed an ecosystem, generate data, build hype.
2. Control Phase — Rate limits. Certificate pinning. MFA requirements. Client assertion. The goal shifts from enablement to extraction and containment.
3. Rentier Phase — Third-party access becomes a licensing negotiation or simply dies. Users are funneled into the OEM's proprietary app, data flows through VW's servers, subscription models become mandatory.

This is exactly how Apple, Google, and increasingly Tesla manage their ecosystems. Volkswagen is simply arriving late to the same playbook.

Social Function

This is transition management theater. VW publicly supports "connected car" innovation while privately closing every aperture that doesn't funnel value back to them. The developer community burns hours reverse-engineering a system VW was always prepared to shut down. The user loses integration flexibility. VW gains another data silo and another friction point that pushes users toward their paid subscription tiers.

The Verdict

Volkswagen has chosen OEM lock-in over ecosystem vitality. The Home Assistant integration is dead unless someone reverse-engineers the client assertion flow — which VW will treat as a Terms of Service violation and litigate if it becomes widespread. The "bug" report will be closed as Won't Fix because the fix is the problem.

The car is becoming a subscription terminal. Your access to it belongs to them.