aserramonner

I have not tried that, but maybe using whitelisting (https://www.home-assistant.io/docs/authentication/providers/) may work for a magic mirror use case, since all api accesses will come from the same IP address.

Thanks a lot for your comment. I'll review when I get a slot.

Thanks a lot for the contribution ! I would not like to break current users of the environment var approach. Any idea about how to combine both approaches ?