Install as a Home Assistant app
Kept runs as a Home Assistant app: Kept and its own database in one app, on Home Assistant OS. No Docker Compose, no passwords to make, and Home Assistant’s backups include it.
Home Assistant app or a normal install?
Section titled “Home Assistant app or a normal install?”Same Kept, same version, same features: things, places, the map and graph, scan, labels, AI, MCP, imports, Paperless, several people.
| Home Assistant app | Compose or Kubernetes | |
|---|---|---|
| Opens | Home Assistant’s sidebar, and Kept’s own address (port 8080) | Kept’s own address |
| Install, update | Home Assistant’s app store | docker compose, helm |
| First account | A Home Assistant admin sets up without the code | The setup code from Kept’s log |
| Settings | The app’s Configuration tab | .env or the chart’s values |
| Offline, installing the phone app, push | Kept’s own address over https; not in the sidebar | Over https |
| Passkeys, OIDC, Google | Kept’s own address (https for passkeys; https and a public domain name for Google) | Kept’s address |
| Backups | Home Assistant’s backups; off the box through its backup locations | Kept’s own nightly backups: restic to a folder, S3 or SFTP |
| Photos and files | In the app’s data | On disk, or S3 |
- The app: you already run Home Assistant OS.
- Compose or Kubernetes: anything else; or photos and files on S3; or Kept’s own off-box backups.
Install
Section titled “Install”- Settings → Apps → Install app → ⋮ → Repositories, add
https://github.com/keptinventory/kept(or use the button above). - Find Kept, then Install, then Start.
- Open Web UI. Kept opens inside Home Assistant, in the sidebar too.
| You need | |
|---|---|
| Home Assistant OS | Apps need the Supervisor: not Home Assistant Container or Core. Supervisor 2026.10.4 or later |
aarch64 or amd64 |
A Raspberry Pi 4 or 5 on 64-bit, a mini PC, a VM |
| 4 GB of memory | 2 GB works with few other apps; Kept with its database uses about 250–320 MB idle |
First start
Section titled “First start”- A Home Assistant administrator who opens Kept from Home Assistant sets it up without a code (Supervisor 2026.10.4 or later; before that the code is needed).
- Anyone else types the setup code from the app’s Log tab (
KEPT SETUP CODE: XXX-XXX). - Kept has its own accounts. People sign in to Kept once, also inside Home Assistant; household members don’t need to be Home Assistant administrators to use it from the sidebar.
Kept’s address
Section titled “Kept’s address”Inside Home Assistant, Kept opens from the sidebar. Phones, printed QR labels, mail links, the
integration and AI apps need an address that works outside a Home Assistant session, so the app
also serves Kept on port 8080. The Log tab names it, for example
Kept is at http://homeassistant.local:8080.
| Option | What |
|---|---|
| Kept’s address | Set it when homeassistant.local doesn’t resolve on your network, or the port changed. http(s)://host[:port], no path. |
| https on Kept’s port | Serves the port over https with Home Assistant’s certificate from /ssl (from the DuckDNS or Let’s Encrypt apps). Restart the app after the certificate renews. |
| Outgoing mail | An smtps:// URL: sign-in links, invites and reminders by mail. |
| OIDC, Google | Sign-in with your own identity provider or with Google. Empty: off. |
| Apprise server | The Apprise API server for Apprise notification channels. Empty: none. |
| Sign-up | true or false locks it open or closed; unset, an admin decides. |
| Upload limit (MB) | 1 to 2048; default 25. |
The provider sends people back to Kept’s own address, never to Home Assistant. Redirect URL to
register: <Kept's address>/api/v1/auth/callback/oidc for OIDC,
<Kept's address>/api/v1/auth/callback/google for Google. The Log tab prints it once the
sign-in is configured. Inside Home Assistant, Sign in with … opens Kept’s address in a new tab.
Google refuses a redirect URL on http, on a .local name or on an IP address
(Google’s rules): set Kept’s address to https with a public domain name,
for example a DuckDNS name with https on Kept’s port. The Log tab warns when it won’t do.
Turning port 8080 off (Configuration → Network) leaves only the sidebar: labels and the phone app then don’t open.
What needs https
Section titled “What needs https”| Plain http | https | |
|---|---|---|
| Things, places, search, labels, photos from a file | yes | yes |
| Personal tokens (the integration), showing secrets, exports | no | yes |
| Passkeys, the camera, installing the phone app, push | no | yes |
Inside Home Assistant, Kept counts as https only when Home Assistant itself is served over https.
A proxy in front of Home Assistant that ends TLS must send X-Forwarded-Proto: https, or Kept sees
plain http. Passkeys belong to Kept’s own address: sign in with one there. More on
the home network.
Backups and updates
Section titled “Backups and updates”- Backups: Home Assistant’s backups include Kept: the database as a dump, photos, files and Kept’s keys. Keep Home Assistant’s backup encryption on. Restoring the backup brings Kept back; the first start after a restore takes a little longer.
- A backup while Kept is stopped holds the dump Kept wrote when it last stopped cleanly: Home Assistant asks only a running app for a fresh one. After a crash, start Kept before backing up.
- Kept’s own backups aren’t in the app: they need the database owner’s login, which the app keeps from the running server. Admin → Backups says so and links to Home Assistant’s backups.
- Off the box: add a network share or a cloud location in Home Assistant’s backup settings (Home Assistant’s backups).
- Updates: the app’s version is Kept’s. An update keeps Kept’s data and upgrades its database on start. Turn on Keep backup of the last version in Home Assistant’s update dialog: Kept’s own pre-upgrade snapshot is off in the app.
The integration
Section titled “The integration”The Kept integration brings what’s due into Home Assistant. Give it Kept’s address and a personal token made over https. Setting it up without a token, straight from the app, comes in a later release.