Aarlo is a custom component for Home Assistant, providing asynchronous access to the Arlo camera and security ecosystem.
Aarlo provides, amongst other things:
- Access to cameras, base stations, sirens, doorbells, and lights.
- Asynchronous, real-time notification of motion, sound, and doorbell press events via MQTT/WebSockets.
- Native peer-to-peer WebRTC live streaming for capable cameras, with instant startup and zero transcode overhead.
- Media playback, snapshots, and direct camera streaming in Home Assistant.
- Environmental sensors (temperature, humidity, air quality) from supported base stations.
- Dedicated switches for alarms, camera snapshots, and doorbell muting.
- Native async service calls and non-blocking integration lifecycle.
Aarlo v0.9 is a major rewrite transitioning the integration and underlying
pyaarlolibrary to native Pythonasyncio.This is an active alpha release — please expect bugs, edge cases, and evolving improvements.
Note on Hardware Testing: The maintainer does not own or have access to every Arlo hardware model (such as all generations of cameras, floodlights, doorbells, chimes, and SmartHubs) and cannot test every permutation. Community testing and feedback are essential to stabilizing this release!
If you encounter issues, regressions, or unexpected behavior with your hardware, please open a GitHub issue. Please include your Home Assistant version, Arlo device models, and relevant logs.
If you need the legacy v0.8 documentation, it is archived in docs/README_v8.md.
- Introduction
- Requirements
- What's New & Changed Defaults in v0.9
- Installing the Integration
- Adding and Configuring the Integration
- Event Stream Backends (MQTT vs. SSE)
- Cloudflare & Network Resiliency
- Diagnostics & Bug Reports
- FAQ
- Supported Devices
- Known Limitations
Aarlo interacts with the Arlo Web APIs to provide full Home Assistant entity support.
With v0.9, all network requests, event listeners, streaming handoffs, and entity controls run asynchronously on Home Assistant's event loop with zero thread-blocking calls.
For advanced configurations (such as customizing video download directories or raw entity naming), see docs/README-advanced.md.
- Dedicated Arlo Account: Aarlo requires a dedicated Arlo account. If you attempt to reuse the same account you use on your mobile phone, the phone app and Home Assistant will constantly disconnect each other.
- Admin Access Rights:
Grant the secondary account
Allow Access Rights(Admin privileges) in your primary Arlo app settings (Settings -> Grant Access). This is required to control base station modes and receive battery/signal updates. - Two-Factor Authentication (2FA): Arlo mandates two-factor authentication. We strongly recommend configuring an Email 2FA factor using IMAP.
In v0.9, the integration has been streamlined so that /config/aarlo.yaml is no longer needed for normal setups. Sane, automated defaults now handle operation out of the box:
http_backend: curl_cffi(Default):- Uses real browser TLS fingerprints (
chrome131) to reliably pass Cloudflare anti-bot verification. cloudscraperremains available as a manual fallback option if needed.
- Uses real browser TLS fingerprints (
- Automated Token Expiry Renewal:
- Reconnects and token renewals are now automatically scheduled to fire 5 minutes before the session token expires.
- Manual periodic reconnect workarounds (e.g.
reconnect_every: 15) are no longer needed.
recent_time: 60(Default):- The camera "recently active" status window defaults to 60 seconds (1 minute), rather than the legacy 60-minute default.
media_retry: [](Default):- Recordings now rely on real-time MQTT push events (
mediaUploadNotification) rather than firing multiple duplicate HTTP polling requests for every video.
- Recordings now rely on real-time MQTT push events (
- Modern Sub-Logger (
pyaarlo.packet):- High-volume packet and protocol tracing is routed through the
pyaarlo.packetlogger. - The legacy
verbose_debug: truesetting inaarlo.yamlis deprecated.
- High-volume packet and protocol tracing is routed through the
- UI Configuration for Backend & Media:
- Event stream protocol (
auto,mqtt,sse), HTTP client (curl_cffi,cloudscraper), and local recording download templates (save_media_to) can now be managed directly in Home Assistant via Configure. - Any existing settings in
/config/aarlo.yamlare automatically imported on startup.
- Event stream protocol (
Aarlo is part of the default HACS store. Search for "Aarlo" under Integrations and download the latest release.
Copy the custom_components/aarlo directory into your Home Assistant /config/custom_components/ directory and restart Home Assistant.
From the Home Assistant UI:
- Navigate to Settings -> Devices & Services.
- Click Add Integration and search for Aarlo.
- Enter your dedicated Arlo account credentials and 2FA settings:
| Field | Description |
|---|---|
| Username | Your dedicated Arlo account email address |
| Password | Your dedicated Arlo account password |
| Two Factor Mechanism | Select IMAP (recommended), PUSH, or NONE |
| TFA Username | Your IMAP email username |
| TFA Password | Your IMAP email password or app-specific password |
| TFA Host | Your IMAP server hostname (e.g. imap.gmail.com) |
Arlo requires two-step verification. Three methods are supported:
Automates two-factor authentication headlessly. When Arlo sends an email with a 6-digit code, Aarlo checks your inbox over IMAP, extracts the code, and completes login without manual intervention.
-
App Passwords Required: Webmail providers like Gmail and Yahoo require an Application Specific Password (not your regular account password) when accessing via IMAP:
-
Common IMAP Hostnames:
- Gmail:
imap.gmail.com - Yahoo:
imap.mail.yahoo.com - Outlook / Office 365:
outlook.office365.com
- Gmail:
Arlo sends a push notification to your phone. You must open the official Arlo app and approve the login request when Home Assistant restarts.
Requires manual verification code entry.
From the Integration page, click Configure on Aarlo to customize integration settings and entities:
- Backend & Media Settings Screen (New):
- Event Stream Backend: Select
auto(MQTT WebSocket, recommended),mqtt, orsse. - HTTP Client Backend: Select
curl_cffi(Chrome TLS fingerprinting, recommended),cloudscraper, orrequests. - Save Media Path Template: Specify a directory template to download MP4 video recordings locally (e.g.
/config/media/${SN}/${Y}/${m}/${d}/${T}). Leave blank to stream on demand without saving files to disk. - Automatic Import: If you have existing settings in
/config/aarlo.yaml, they are automatically imported into this screen on startup.
- Event Stream Backend: Select
- Alarm Setting Screen: Customize home/away/night mode names, disarm codes, and siren trigger duration.
- Binary Sensors Screen: Enable or disable motion, sound, doorbell press, cry, contact, light, and leak sensors.
- Sensors Screen: Enable battery level, signal strength, capture history, and environmental sensors.
- Switches Screen: Add switches to trip sirens, request snapshots, or silence doorbell chimes.
Arlo supports two streaming protocols for pushing real-time events to Home Assistant:
auto/ MQTT over WebSockets (Default):- The modern protocol used by Arlo's official web and mobile apps.
- Lightweight and supports concurrent connections.
- The broker URL is dynamically assigned by Arlo during authentication.
sse(Fallback):- HTTP Server-Sent Events stream (
/subscribe). - Retained as a fallback if your account or devices do not push events over MQTT.
- Limitation: Arlo restricts SSE to a single connection per account.
- HTTP Server-Sent Events stream (
To change or override the backend, click Configure on the Aarlo integration in Home Assistant and select your preferred backend on the first screen (or optionally specify backend: in /config/aarlo.yaml).
Arlo protects its login endpoints with Cloudflare anti-bot checks.
- In v0.9, Aarlo defaults to
curl_cffi, which impersonates authentic browser TLS fingerprints (chrome131) to pass Cloudflare verification cleanly. - To switch the HTTP backend (e.g. to
cloudscraperorrequests), click Configure on the Aarlo integration in Home Assistant and adjust the HTTP Client Backend dropdown on the first screen (or optionally specifyhttp_backend:in/config/aarlo.yaml).
Standard logging in configuration.yaml allows granular control over log output:
logger:
default: info
logs:
# Standard integration logs (device states, mode changes, connections)
pyaarlo: debug
custom_components.aarlo: debug
# Optional: Enable raw packet tracing (replaces verbose_debug)
pyaarlo.packet: debugTip: You can toggle
pyaarlo.packet: debugon and off dynamically without restarting Home Assistant via Developer Tools -> Actions ->logger.set_level.
If reporting an issue with an unsupported device or an unhandled packet:
- Open my.arlo.com in Chrome, Firefox, or Edge.
- Open Developer Tools (
F12), go to the Network tab, and check Preserve log. - Perform the action (e.g. view stream, arm device, toggle light).
- Right-click any network request and select Save all as HAR with content.
.har files and raw packet traces contain session tokens and device identifiers:
- Anonymize and encrypt the file using the encryption page or via the
pyaarloCLI:cat trace.log | pyaarlo-utils anonymize | pyaarlo-utils encrypt > trace.log.enc
- Attach the encrypted output to a GitHub Issue. Only maintainers holding the private key can decrypt it.
No. Arlo's servers do not support simultaneous logins on the same credentials. Create a free second Arlo account, grant it Admin access to your devices, and use those credentials in Home Assistant.
Arlo cameras are battery-optimized and stay in deep sleep until an event or stream is requested. Initiating a stream requires communicating through the cloud to wake the camera and establish an RTSP/HLS stream back to Home Assistant.
No subscription is needed for live viewing, motion events, snapshots, or local RTSP streaming. Arlo requires a subscription to access cloud-stored video recordings.
Most Arlo devices are supported, including:
- Cameras: Arlo HD (VMC3030), Pro (VMC4030), Pro 2/3/4/5 (VMC4040/VMC4041/VMC4060), Ultra (VMC5040), Essential & Essential 2 (VMC2030/VMC2040/VMC3060), Go & Go 2 (VML4030/VML2030), Arlo Baby (ABC1000).
- Doorbells: Audio Doorbell (AAD1001), Video Doorbell Wired & Wireless (AVD1001, AVD2001, AVD3001, AVD4001).
- Lights: Arlo Light (AL1101), Pro 3 Floodlight (FB1001).
- Sensors & Base Stations: All-in-One Sensor (MS1001), Base Station (VMB3000/VMB4000/VMB4500/VMB5000).
- Advanced Configuration Guide — Custom video directories, raw entity naming, and advanced parameters.
- Legacy v0.8 Documentation — Preserved synchronous v0.8 documentation.
- v0.9.0-alpha.9 Release Notes — Modern entity naming, unified lights, device removal, and pyaarlo v0.9.0-alpha.9.
- v0.9.0-alpha.8 Release Notes — Native WebRTC streaming and SIP camera support.
- v0.9.0-alpha.7 Release Notes — Automated local media retention and disk cleanup.
- v0.9.0-alpha.6 Release Notes — Defensive YAML loading and default options preservation.
- v0.9.0-alpha.5 Release Notes — Fix SSE stream connectivity with curl_cffi and pyaarlo v0.9.0-alpha.5.
- v0.9.0-alpha.4 Release Notes — Push 2FA rate-limit protection, troubleshooting matrix, and pyaarlo v0.9.0-alpha.4.
- v0.9.0-alpha.3 Release Notes — Discouraged configuration warnings, session transaction refactor, and pyaarlo v0.9.0-alpha.3.
- v0.9.0-alpha.2 Release Notes — Session stability, request draining, V3 mode sync, and API normalization.
- v0.9.0-alpha.1 Release Notes — Detailed overview of the v0.9 async rewrite.
- Cloud Dependency: All authentication and stream negotiation routes through Arlo's cloud infrastructure.
- Cloudflare Verification: Arlo periodically changes anti-bot challenges;
curl_cffikeeps these working reliably. - Hardware Permutations: With dozens of camera models and firmware variations, unexpected packets occasionally appear. Please report unhandled events with debug logs so they can be incorporated.
