Home Assistant's development branch now accepts sign-ins through a Tailscale address, a global IPv6 address or another public IP. The fix by Joakim Plate (elupus), reviewed by balloob, was merged on 17 October 2026. It went into the dev branch, so it should arrive with Home Assistant 2026.11 rather than in a 2026.10 patch release.
The error
During login the frontend identifies itself with an IndieAuth client_id, which is simply its own address. Home Assistant only accepted domain names and local network IP addresses there. If you opened the interface at a raw Tailscale IP (the 100.64.0.0/10 range) or a public IPv6 address, you got "Invalid client id" instead of the login page.
The odd part was that it depended on the port. Issue #178390, opened in August, describes a Tailscale setup that worked on http://100.x.x.x:8123 and broke as soon as the HTTP port was changed to 80. Issue #186365, opened on 14 October, reports the same with a public IPv6 address on 2026.10.1.
A hole first, then the fix
The port dependence came from a bug in the check itself. It parsed the host together with the port, so an address such as http://8.8.8.8:8123/ did not look like an IP address and passed as a domain name, bypassing the local-network restriction. A first pull request (#186537), merged a few days earlier, made the check look at the hostname alone. On its own it would have broken the logins that only worked thanks to that hole: public IPs and Tailscale addresses with a port would have been rejected too, which is why it carries the breaking-change label.
The second pull request (#186543) adds the missing case. Home Assistant now also accepts a client_id whose scheme and host, port included, match the request the browser actually sent. Behind a trusted reverse proxy that reaches Home Assistant by IP address, the X-Forwarded-Proto and X-Forwarded-Host headers are taken into account. Domain names and local IP addresses keep working as before.
The author points out that the client_id is not a credential. The authorization code stays tied to redirect addresses controlled by the owner of that client_id, so accepting the request's own address does not weaken that binding.
What it means for you
If you reach Home Assistant at a raw Tailscale IP or a public IPv6 address and have hit "Invalid client id", the workarounds so far were a hostname (a Tailscale MagicDNS name or your own domain) or staying on port 8123. With 2026.11 the address the browser uses should work on any port.