What authentication does the Google Home Local API use?

Each request must include a cast-local-authorization-token header bound to the Google account that set up the speaker. The token is short-lived and must be refreshed via Google's account services. Jentic stores the token in its encrypted vault and injects it at request time so the raw value never enters the agent's context.

Can I set alarms on a Google Home speaker through this API?

Yes. The /setup/assistant/alarms endpoints let you list existing alarms and create or delete entries on a specific device, and /setup/assistant/timers covers the equivalent timer operations. Each call targets one device by IP, so the agent must first discover the speaker on the local network.

What are the rate limits for the Google Home Local API?

Google does not publish rate limits for the local API because it is intended to be reached over the LAN by a single Home app instance. In practice, polling more than once every few seconds per device can cause the speaker to drop the connection, so back off after any 5xx response.

How do I list alarms on a Google Home speaker through Jentic?

Run jentic search 'list google home alarms', load the returned operation schema, and execute it with the device's local IP and the stored cast-local-authorization-token. The agent receives a typed list of alarm objects with fire time, recurrence, and ID, ready to be used in subsequent delete or update calls.

Does the API work over the internet or only on the local network?

The Google Home Local API only responds on the same LAN as the speaker - port 8443 on the device's IP. It is not reachable from the public internet, so any agent using it must run on a host inside the home network or via a VPN tunnel.

Can I limit what my agent is allowed to do with the Google Home API?

Yes. Because Google Home local control runs through top-level setup endpoints rather than a resource id in the URL path, you scope the agent by choosing exactly which operations it may call from your own self-hosted Jentic One instance, guided by your own rules. You can, for example, allow only read operations like getting the app device ID or checking assistant readiness while withholding the alarm and timer create and delete calls. The cast-local-authorization-token is stored once and injected at execution time, so the agent only ever exercises the operations and credentials you permit.