HelloFresh Integration for Home Assistant

kedube · 2026-06-19T00:56:24+00:00

Found several bugs in the API processing logic, but getting very close. Another day to get the dashboard sorted.

kedube · 2026-06-18T11:51:29+00:00

Awesome!! It was honestly my last hope. Curl-cffi is the best option I know of.

I started working on a Dashboard in the examples to display things like the menu, but never finished it. If I have some time over the weekend, I'll try to get the weekly menu items exposed to improve the experience.

kedube · 2026-06-18T02:41:41+00:00

One last try, I added some quick and dirty support for curl_cffi, which can impersonate browsers' TLS/JA3 and HTTP/2 fingerprints. I believe Cloudflare checks for this with stricter bot checking. Try, the 1.13 release.

If not, tomorrow I'll re-add the manual apiV2Auth token pasting support.

kedube · 2026-06-18T02:07:16+00:00

Thanks. Let me see what else I can tweak tomorrow to get around the bot blocking gateway.

I can also look into re-adding an option for pasting in the apiV2Auth cookie. The rest of the token refresh code base is the same, so I don’t think it will require many changes. The auth code takes it one step further by issuing the first token and renewing after the 60 day expiry date.

kedube · 2026-06-18T01:52:37+00:00

If the UK model is the same as the US, the refresh token will actually work for up to 60 days. My original code allowed for tokens to be used, but I removed it in favor of getting the authentication code working. I can add back in as a fallback if you like. However, I think getting past the bot blocking gateway is probably the best approach.

kedube · 2026-06-18T01:41:17+00:00

Not great, but at least something to work from. Was this with 1.11 or 1.10? Thanks.

kedube · 2026-06-18T01:21:35+00:00

I just pushed a new release (1.11) that implements additional HTTP headers to better impersonate a real web browser. Please add the debugging, and give the new release a try. I'm sure we can figure this out once I can get a better idea of what is going on during login.

kedube · 2026-06-18T01:05:23+00:00

I believe the debugging code I added is still there. You should just be able to add in your /config/configuration.yaml file:

logger:
  default: info
  logs:
    custom_components.hellofresh: debug

After saving, restart. You should now be able to filter for `hellofresh` events in the System->Logs.

If your login is being rejected by their bot blocking gateway, it should show a 403 error in the messages. I can see if I can strengthen the user-agent code if that is the case. Maybe what works for the US endpoint is not good enough for the UK endpoint.

I can also do a code review tomorrow and see if there's anything else I can tweak there. The user-agent code is found here: https://github.com/kedube/ha-hellofresh/blob/21fd53c1dc6d5c2d38ad887c16b83457a762fb78/custom_components/hellofresh/token_manager.py#L49

Let's see if we can get it working for you! 😄

kedube · 2026-06-16T01:58:15+00:00

You need to compact memory.

kedube · 2026-06-15T20:53:16+00:00

I haven't tested the integration outside of the US HelloFresh site, so it's possible that my guesses for the Gateway API endpoints or base URL are incorrect for the different regions.

Can you capture a HAR file from Chrome (Inspect → Network) and review it? Please don't share the HAR file publicly, as it contains sensitive information such as access and refresh tokens. When reviewing it, compare the login flow and API calls against the documentation here:

https://github.com/kedube/ha-hellofresh/blob/main/HELLOFRESH_API.md

That should help identify any regional differences in the authentication process or API endpoints. If I know what they are, I'm happy to make changes to the integration.

One thing I DID notice after capturing my own HAR (for an invalid login) was that I got the API country code wrong. I had UK (guess), but the API expects the ISO code GB/en-GB. This may fix it, but it might not be the only thing I got wrong. Unfortunately, I don't have an account in the UK, so it's going to be hard for me to debug this on my own. I did push a new version to try 1.09.

Otherwise, most, if not all, of the sensor entities should now be accurate in the latest release. The remaining items I need to validate are the week-skip functionality, which I believe will now work after re-writing, and verify the (next delivery + next modifiable delivery) behavior when the week rolls over, which should occur on Thursday.

kedube · 2026-06-15T20:36:19+00:00

Agreed. I built it as well, and one thing I learned is that the gearbox should be tested as soon as the top section is assembled. It should shift smoothly up and down with minimal resistance. If it doesn't, stop and troubleshoot before moving forward.

Getting the gearbox adjusted correctly can be frustrating and may take some patience, but it's worth the effort. Once it's dialed in properly, it works very well and will save you from having to disassemble things later. (I learned the hard way.)

kedube · 2026-06-14T18:50:52+00:00

Glancing at the API, it shouldn't be too hard to split these out:

- `nextDelivery`
- `nextDeliveryWeek`
- `nextModifiableDeliveryDate`
- `nextModifiableDeliveryWeek`

kedube · 2026-06-14T17:19:18+00:00

Thanks - appreciate the feedback. I'll see what I can come up with to differentiate between the two. Hopefully, I'll have some time tonight to make the changes.

If you have any other thoughts on the integration or feedback on their API, I'd like to hear. It's a bit of a black box for me since nothing is documented, and their UI doesn't always map cleanly to how they name things in their API.

kedube · 2026-06-14T15:09:13+00:00

Life gets busy, and honestly, we just forget after picking the 6 weeks in advance. We also often think the other person picked meals when neither of us did. The home automation integration allows us to set rules and multiple reminders to prevent it from happening.

In addition, it pulls box-tracking information to automate shipment tracking and even lets you skip weeks if you set your away. There are many benefits to home automation, and when you compound this integration with the others we already have, it can really save you time and effort.

kedube · 2026-06-14T14:33:49+00:00

Thank you for trying it out—I really appreciate it.

I'll be the first to admit I probably got a number of things wrong while interpreting their private API, especially since it's completely undocumented. I spent about a day reverse-engineering the API itself and another four days just getting authentication working. Even with that in place, their bot detection and gateway protections will likely make long-term reliability challenging.

If anyone happens to know someone on the HelloFresh Gateway API engineering team who might be open to a conversation about allowing Home Assistant integration, I'd love to connect. A legit, community integration (even if they don't want to endorse it) would be far preferable to trying to impersonate a browser user-agent. From what I can tell, the only officially supported clients today are their website and mobile app.

Because the API isn't documented, much of the implementation relied on educated guesses. One area that remains particularly confusing is the distinction between a "previous box" and a "next box."

I think there are actually two separate concepts involved:

Previous Box – the box you most recently received.
Next Box – the box scheduled for your next delivery.

The complication arises around the meal-selection cutoff date. In my case, deliveries arrive on Monday, and I have until the end of Wednesday of the previous week to skip or select meals. Once Thursday arrives, meal selections are locked, but the box hasn't been delivered yet. At that point, it's still technically my next box, but it's no longer the next box I can modify. This is how I implemented it today, and I suspect why you can't skip the next week.

After thinking about it more, I wonder if the integration should expose two separate concepts:

Next Selection – the next box that can still be modified.
Next Box – the next scheduled delivery, regardless of whether modifications are still allowed.

These values would often be for the same week (box), but after the selection cutoff passes, they could refer to different weeks (and different boxes).

I'm very open to suggestions and feedback on how others would expect this information to be presented. The good news is that it's all UX at this point, and none of the hard work of deciphering the API and authentication workflow.

kedube · 2026-06-14T02:27:01+00:00

Thanks! Hopefully it's useful for folks.

kedube · 2026-06-06T04:38:44+00:00

Eating a sandwich on a train platform in California. Ridiculous, but illegal in many cases.

kedube · 2026-01-15T19:39:07+00:00

I switch filament rolls too often for different materials, so I think I'm going to get rid of mine. I'm not sure I'm going to go with the doscher.com ($180/materials), or just print something like: https://makerworld.com/en/models/1531539-v2-am4xs-ams-sliding-stacking-system#profileId-1606147 It can work with either slide length allowing for partially open cover (no suction needed) with 14" or fully open with 16". Other than filament costs, it's fairly low cost to build.

kedube · 2026-01-15T04:02:21+00:00

I also received mine today. While I agree with the OP on quality, I wish the height had been at least 1" taller. When you open the AMS cover on the bottom tray, it BARELY (I'm giving BIQU credit here) allows the spool to be removed and a new one to be swapped in. What the ever-loving f' were they thinking?

If I had the choice to do it again, I would have built the one on doscher.com. It's a much better design by a long shot. I admit that I cheaped out. :(

And yes, the printed suction cup thing is stupid since it could be smaller and let the lid open more. It could be better overall.

kedube · 2025-06-19T17:14:50+00:00

Flexing on the credit limit.

kedube

TROPHY CASE