How to connect Google Nest

Link Google Nest to Port OS to control your Nest thermostats and read temperature and camera live view. You create your own Google Cloud OAuth client and a Device Access project, and give Port OS the client ID, the client secret and the Device Access project ID. This works for any account. Motion, person and doorbell notifications need Google's event feed and are not available yet on this connection; see What works on this connection.

The website flow has two separate steps. First you choose Save credentials, which stores the values as this plugin's one configuration. Then, now or in a later session, you choose Connect to Google Nest. Once a configuration is saved the Set up the connection step collapses and Connect to Google Nest is the only primary button; open Set up the connection again to see the Redirect URI, change the saved values (the client secret stays masked) or delete the configuration, which asks you to confirm. Saving again updates the same configuration and never creates a second one, and a failed or cancelled authorization leaves it in place so you can try again. Nothing is connected until Google Nest returns and Port OS completes the link.

Create your Google Cloud client and Device Access project

You need a personal Google account (a Google Workspace account cannot register for Device Access) that owns a Nest home with a supported thermostat. The work has two parts: an OAuth client in Google Cloud, then a Device Access project that links to it.

1. Copy the Redirect URI from Port OS

In Port OS, open Add a device and choose Google Nest. Under How do you want to connect Google Nest?, choose Use my own app. Copy the value under Redirect URI to register in your Google Nest app with Copy redirect URI. Keep this tab open; you return to it in step 12. On the hosted service the value is below; the screen is the source of truth.

Text

https://auth.portoperatingsystem.com/plugins

2. Open Google Auth Platform

In the Google Cloud console, select a project you own or create one, and enable the Smart Device Management API for it. Then open Google Auth Platform and click Get started.

3. Name the app

Enter an app name, for example Port OS Nest, and choose a user support email from the list. Click Next.

4. Choose External

Under Audience, choose External. The app starts in testing mode, which is all Port OS needs; you do not need to publish it.

Enter a contact email, agree to the Google API Services user data policy, then click Create.

6. Add yourself as a test user

Open Audience and, under Test users, click Add users. Add the Google account that owns your Nest home. While the app is in testing mode, only test users can sign in.

7. Create the OAuth client

Open Clients and click Create client. Set Application type to Web application and enter a name. Under Authorized redirect URIs, click Add URI and paste the Redirect URI from step 1. Click Create.

8. Copy the client ID and client secret

Google shows the new client ID and secret. Copy both now: the dialog does not show the secret again. You can add a new secret later from the client's page. Treat the secret like a password.

9. Register for Device Access

Open the Device Access console and sign in with the same Google account. Google charges a one-time US$5 registration fee per Google account, and you accept its terms, before you can create a project.

10. Create a Device Access project

Click Create project.

Enter a project name. Google shows this name on its consent screen. Click Next.

Paste the OAuth client ID from step 8 and click Next. This links the client to the project, and each client ID can belong to one project only.

Leave Enable events off and click Create project. Port OS does not use Nest events on this connection.

11. Copy the Project ID

The project page shows a Project ID, a UUID. This is not your Google Cloud project ID. Copy it.

12. Enter the values in Port OS

Back in Port OS, enter the client ID in OAuth client ID, the client secret in OAuth client secret and the Project ID in Device Access project ID, then click Save credentials. Port OS stores the secret on the backend and never shows it again. The credentials are now saved and nothing is authorized yet: continue with the next step now, or come back later and choose Connect to Google Nest. You do not need to enter them again.

13. Approve access on Google

Google asks you to choose your Nest home and approve access to your devices. Sign in with a test user from step 6 and approve. Port OS then lists your devices and shows Nest as connected.

What works on this connection

Port OS lists your Nest devices and lets you set a thermostat's target temperature and mode.
Temperature works. Port OS reads each thermostat's and display's current temperature from Google when you ask for it.
Camera live view works. Cameras and doorbells that support live streaming appear as cameras you can open a live view of, using your own Device Access project.
Motion, person and doorbell notifications are not available yet. They need Google's event feed, which Port OS does not subscribe to on this connection, so nothing is pushed to Port OS when a camera sees motion, a doorbell rings or a temperature changes, and no event subscription (see the event subscriptions guide) can fire from Nest. Camera event-image snapshots need the same feed and are not available either. Port OS shows these as unsupported for this connection rather than as an error.
No Pub/Sub topic or subscription is needed.
Changing the OAuth client ID or the Device Access project ID requires deleting the connection and connecting again.

Redirect URI

The Authorized redirect URI in Google Cloud must match the value the Port OS connect screen shows, character for character, including the scheme, host, path and any trailing slash. Google sends you back to the Port OS auth host, which relays the result to the website.

Troubleshooting

Redirect mismatch (Google shows "redirect_uri_mismatch"). The Authorized redirect URI differs from the one Port OS shows. Copy it again from the connect screen and save the OAuth client in Google Cloud.
Invalid client (invalid_client). The client ID or secret is wrong, or the secret was replaced. Re-enter both and save again before authorizing.
The device list fails after you approve. The Device Access project ID is wrong, or the OAuth client is not linked to that project. Port OS requests the device list when it completes the link, so a wrong project ID fails the connection. Check the project ID and the linked client ID in the Device Access console, then delete the connection and connect again. An account with no devices connects with an empty list; that is not an error.
AUTH_LINK_NOT_READY. The connection is still a draft that is missing required values: the client ID, the client secret or the Device Access project ID. Save all three, then authorize.
Stale callback. An authorization that was started earlier, or opened twice, can return after it expired or was replaced. Close the tab and choose Connect to Google Nest again. Changing the Device Access project or client ID on an existing connection means deleting the connection and connecting again; the previous attempt is not reused.