AI access and keys
The "AI access" menu item
Every panel's view has the item 🤖 AI access. All threads of the AI integration come together here:
- Generate key – for your own programs, scripts and assistants that cannot sign in with an account.
- Existing keys – overview with identifier, permissions, last use; each key individually revocable.
- Connected services – the links created via account sign-in (Alexa, ChatGPT, MCP clients) with scope and last use; also individually disconnectable.
- Setup instructions for ChatGPT, Claude and other assistants.
Permission required: AI access is managed by whoever has the "AI access" permission on this panel – by default the main user.
The security model
Three principles apply to every AI access:
- An access belongs to exactly one panel – not to the whole account.
- An access has a scope (see table) – only these function groups are reachable.
- An access can never do more than its owner: on every request the current permissions of the person who owns the access are checked. Revoked permissions take effect immediately.
The scopes
| Scope | Allows |
|---|---|
| Read | Query devices, state, rules, log |
| Switch devices | Lights, sockets, shutters, thermostats, scenes |
| Edit automations | Create/change rules and scenes |
| Pair detectors | Learning mode, naming devices |
| Arm/disarm | Change mode – the user code is still required with every command |
| Change settings | Email/SMS, sirens, reporting – powerful, deliberately separate |
Generating a key
- Open AI access, assign a name (e.g. "ChatGPT home control").
- Tick the scopes – as few as possible, as many as needed.
- Generate key: the plain-text key is shown exactly once – copy it now. Only a checksum is stored; even we cannot display it again.
The key is stored at the assistant as a bearer token (for GPT actions: authentication "API key", type Bearer).
Key or account sign-in?
| Key | Account sign-in (OAuth) | |
|---|---|---|
| Setup | Copy and paste the key | "Sign in" button in the assistant |
| Suited for | Own programs, scripts, assistants without a login window | ChatGPT, Claude, modern MCP clients |
| Management | "Existing keys" | "Connected services" |
For ChatGPT and Claude the account sign-in is the more convenient route – chapter ChatGPT and Claude.
Why AI-created rules are safe
An assistant only formulates the intent ("hallway light on for 60 seconds when the door contact opens") – the actual panel rule syntax is built by the Alarmanlagenmanager. The assistant therefore cannot inject faulty or dangerous rule strings. Before saving, it also fetches a plain-language preview and shows it to you for confirmation.