Handle Netatmo API rate limit with token refresh and retry#167961
Handle Netatmo API rate limit with token refresh and retry#167961synchopate wants to merge 1 commit intohome-assistant:devfrom
Conversation
Netatmo API rate limit is per-token (~500 requests per time window). When rate-limited, refreshing the OAuth token immediately resets the quota. This adds automatic token refresh and retry in both api.py (covers all commands) and data_handler.py (covers polling). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
![home-assistant[bot]](https://avatars.githubusercontent.com/in/97978?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hello @synchopate,
When attempting to inspect the commits of your pull request for CLA signature status among all authors we encountered commit(s) which were not linked to a GitHub account, thus not allowing us to determine their status(es).
The commits that are missing a linked GitHub account are the following:
1dae78dde0a081fcc0464eb9d808ad78bf44e593- This commit has something that looks like an email address (paolo@synchopate.com). Maybe try linking that to GitHub?.
Unfortunately, we are unable to accept this pull request until this situation is corrected.
Here are your options:
-
If you had an email address set for the commit that simply wasn't linked to your GitHub account you can link that email now and it will retroactively apply to your commits. The simplest way to do this is to click the link to one of the above commits and look for a blue question mark in a blue circle in the top left. Hovering over that bubble will show you what email address you used. Clicking on that button will take you to your email address settings on GitHub. Just add the email address on that page and you're all set. GitHub has more information about this option in their help center.
-
If you didn't use an email address at all, it was an invalid email, or it's one you can't link to your GitHub, you will need to change the authorship information of the commit and your global Git settings so this doesn't happen again going forward. GitHub provides some great instructions on how to change your authorship information in their help center.
- If you only made a single commit you should be able to run
(substituting "Author Name" and "
git commit --amend --author="Author Name <email@address.com>"email@address.com" for your actual information) to set the authorship information. - If you made more than one commit and the commit with the missing authorship information is not the most recent one you have two options:
- You can re-create all commits missing authorship information. This is going to be the easiest solution for developers that aren't extremely confident in their Git and command line skills.
- You can use this script that GitHub provides to rewrite history. Please note: this should be used only if you are very confident in your abilities and understand its impacts.
- Whichever method you choose, I will come by to re-check the pull request once you push the fixes to this branch.
- If you only made a single commit you should be able to run
We apologize for this inconvenience, especially since it usually bites new contributors to Home Assistant. We hope you understand the need for us to protect ourselves and the great community we all have built legally. The best thing to come out of this is that you only need to fix this once and it benefits the entire Home Assistant and GitHub community.
Thanks, I look forward to checking this PR again soon! ❤️
home-assistant
bot
added
cla-error
integration: netatmo
Top 200
|
Please take a look at the requested changes, and use the Ready for review button when you are done, thanks 👍 |
|
Hey there @cgtobi, mind taking a look at this pull request as it has been labeled with an integration ( Code owner commandsCode owners of
|
There was a problem hiding this comment.
Pull request overview
Note
Copilot was unable to run its full agentic suite in this review.
Adds Netatmo-specific handling for per-token rate limiting by forcing an OAuth token refresh and retrying requests/polling when ApiThrottlingError is raised.
Changes:
- Add
async_post_requestoverride that refreshes the OAuth token and retries once onApiThrottlingError - Add rate-limit exception handling during polling to force a token refresh for subsequent cycles
Reviewed changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated 4 comments.
| File | Description |
|---|---|
| homeassistant/components/netatmo/api.py | Retry POST requests once after forcing an OAuth token refresh on throttling |
| homeassistant/components/netatmo/data_handler.py | Detect throttling during periodic fetch and force token refresh for later polls |
| return await super().async_post_request(url, params) | ||
| except pyatmo.ApiThrottlingError: | ||
| _LOGGER.warning("Rate limit hit, refreshing token and retrying: %s", url) | ||
| self._oauth_session.token["expires_at"] = 0 | ||
| await self._oauth_session.async_ensure_token_valid() | ||
| return await super().async_post_request(url, params) |
There was a problem hiding this comment.
Both calls pass params positionally into super().async_post_request(...). If the superclass signature differs (e.g., has additional positional args or uses a different second parameter), this can break at runtime. Prefer passing by keyword to make the call resilient to signature changes: call super().async_post_request(url, params=params) in both places.
| return await super().async_post_request(url, params) | |
| except pyatmo.ApiThrottlingError: | |
| _LOGGER.warning("Rate limit hit, refreshing token and retrying: %s", url) | |
| self._oauth_session.token["expires_at"] = 0 | |
| await self._oauth_session.async_ensure_token_valid() | |
| return await super().async_post_request(url, params) | |
| return await super().async_post_request(url, params=params) | |
| except pyatmo.ApiThrottlingError: | |
| _LOGGER.warning("Rate limit hit, refreshing token and retrying: %s", url) | |
| self._oauth_session.token["expires_at"] = 0 | |
| await self._oauth_session.async_ensure_token_valid() | |
| return await super().async_post_request(url, params=params) |
| return await super().async_post_request(url, params) | ||
| except pyatmo.ApiThrottlingError: | ||
| _LOGGER.warning("Rate limit hit, refreshing token and retrying: %s", url) | ||
| self._oauth_session.token["expires_at"] = 0 | ||
| await self._oauth_session.async_ensure_token_valid() | ||
| return await super().async_post_request(url, params) |
There was a problem hiding this comment.
Both calls pass params positionally into super().async_post_request(...). If the superclass signature differs (e.g., has additional positional args or uses a different second parameter), this can break at runtime. Prefer passing by keyword to make the call resilient to signature changes: call super().async_post_request(url, params=params) in both places.
| return await super().async_post_request(url, params) | |
| except pyatmo.ApiThrottlingError: | |
| _LOGGER.warning("Rate limit hit, refreshing token and retrying: %s", url) | |
| self._oauth_session.token["expires_at"] = 0 | |
| await self._oauth_session.async_ensure_token_valid() | |
| return await super().async_post_request(url, params) | |
| return await super().async_post_request(url, params=params) | |
| except pyatmo.ApiThrottlingError: | |
| _LOGGER.warning("Rate limit hit, refreshing token and retrying: %s", url) | |
| self._oauth_session.token["expires_at"] = 0 | |
| await self._oauth_session.async_ensure_token_valid() | |
| return await super().async_post_request(url, params=params) |
| except pyatmo.ApiThrottlingError: | ||
| _LOGGER.warning("Rate limit hit, refreshing token and retrying: %s", url) | ||
| self._oauth_session.token["expires_at"] = 0 | ||
| await self._oauth_session.async_ensure_token_valid() | ||
| return await super().async_post_request(url, params) |
There was a problem hiding this comment.
Token refresh is performed without synchronization. If multiple concurrent commands hit the rate limit at the same time, they can race on self._oauth_session.token updates and trigger multiple refreshes, potentially causing unnecessary auth traffic and inconsistent token state. Consider guarding the refresh+retry path with an asyncio.Lock shared by the auth instance (and re-checking token validity after acquiring it) so only one refresh happens at a time.
| try: | ||
| self.auth._oauth_session.token["expires_at"] = 0 | ||
| await self.auth._oauth_session.async_ensure_token_valid() | ||
| _LOGGER.info("Token refreshed successfully after rate limit") | ||
| except Exception: | ||
| _LOGGER.exception("Failed to refresh token after rate limit") |
There was a problem hiding this comment.
Catching a bare Exception here will also catch asyncio.CancelledError (common during shutdown/unload), which can prevent proper task cancellation. Prefer either (a) explicitly re-raising asyncio.CancelledError, or (b) narrowing the except clause to the expected refresh-related exception types so cancellations and other control-flow exceptions propagate correctly.
Summary
ApiThrottlingErroris not specifically handled: commands (light.turn_on,cover.open_cover, etc.) fail silently and polling degrades for hours until the rate limit window expires.api.py(async_post_request): catchesApiThrottlingError, invalidates the token, refreshes it, and retries the request. This covers all user-initiated commands.data_handler.py(async_fetch_data): catchesApiThrottlingErrorbefore the genericApiErrorhandler, forces a token refresh so subsequent polling cycles use a fresh token with a reset quota.Details
The key insight is that Netatmo tracks rate limits per access token, not per user or IP. By forcing
expires_at = 0on the OAuth session and callingasync_ensure_token_valid(), we obtain a new token with a fresh rate limit quota.Changes
homeassistant/components/netatmo/api.py:async_post_requestoverride toAsyncConfigEntryNetatmoAuthApiThrottlingError: invalidate token, refresh, retry oncelogging,Any,ClientResponse_LOGGERhomeassistant/components/netatmo/data_handler.py:except pyatmo.ApiThrottlingErrorblock before the genericexcept (NoDeviceError, ApiError)handlerTest plan
Notes
Tested in production on a Home Assistant instance with multiple Netatmo integrations (weather, cameras, thermostats). After hitting rate limits, token refresh consistently restored full functionality immediately rather than waiting hours for the rate limit window to expire.
🤖 Generated with Claude Code