Ability to create API keys

[danielrosehill]

I see that you added an OpenAPI compliant API doc recently which is amazing!

As I shared before, I would love to be able to integrate my instance with a cloud/local LLM to query and add inventory through natural language.

I played around with the API a bit and (from what I could see) the authentication method requires on username + password to get a token.

The ability to create a user API key, I guess, would improve the process and security.

[WhiteSockedDancer]

I want to try the same thing and i also struggle with the api key.
I wanted to try this repo to build a mcp server that i can use for tool calls in my home assistant:
https://github.com/ckanthony/openapi-mcp?tab=readme-ov-file#running-the-weatherbit-example-step-by-step

[WhiteSockedDancer]

I got this to work with a temporary bearer token that lasts ~ a month.

[LokiMetaSmith]

here's my attempt at creating an all in one proxmox install script and Homebox and Homebox-mcp server.

https://github.com/LokiMetaSmith/Homebox-mcp

[Duelion]

I'm the maintainer of Homebox Companion, a third-party app for AI photo cataloging. First, I want to say that the Homebox team has done an excellent job with the API and its documentation, enabling third-party apps like mine.

I want to share my perspective on this feature request, especially now that OIDC support is here. Many users have asked me to support OIDC in the Companion app as well, but in its current form, this is not strightforward.

The main challenges are (not suggesting they need to be changed, just stating the facts as I understand them):

• While the API provides OIDC endpoints, these are redirect-based, so, unlike the User Login endpoint, they do not return a attachmentToken in the response body.
• If HBOX_OPTIONS_ALLOW_LOCAL_LOGIN=false is set, password login can be disabled entirely, leaving no way for a third-party app to authenticate.

At the moment, my only workaround would be to ask users to deploy Homebox Companion under the same domain with subpath routing, so I could access the homebox cookies directly. This is far from ideal, it makes deployment significantly harder for users and adds complexity to the codebase in order to support multiple authentication workflows.

API keys would solve these issues cleanly and would pave the way for more integrations beyond just mine.