1. Use a Long-lived access token — not a copied session token
The most common cause. In Home Assistant, click your user name (bottom-left) › Security tab › scroll to Long-lived access tokens › Create token. Copy the entire value when it's shown (it's shown only once) and paste it into Threadlytics. Tokens copied from a browser's developer tools or from other apps are usually short-lived session tokens that expire within minutes — they will 401 shortly after. Threadlytics inspects the token when a test fails and tells you if it looks like a session token or has expired.
2. Verify the token outside Threadlytics — nothing to install
From any computer on your network (Terminal on macOS, PowerShell on Windows), run — with your own URL and token:
curl -H "Authorization: Bearer YOUR_TOKEN" http://homeassistant.local:8123/api/
A working token returns {"message": "API running."}. If this also returns 401, the token itself is the problem regardless of any app — create a fresh one (step 1). If curl works but Threadlytics doesn't, contact us with your Home Assistant version — that's a bug we want.
3. Check the token still exists — and whose it is
Long-lived tokens can be deleted from the same Security page — and they belong to the user who created them. If the token was made while logged in as a different Home Assistant user (or that user was removed), it will 401. Log in as yourself and create your own.
Seeing 403 instead?
A 403 usually isn't the token at all. Home Assistant bans an IP address after repeated failed logins (see config/ip_bans.yaml on your server), and some reverse-proxy setups block unfamiliar clients. Remove the ban entry or allow the phone's IP and try again.
Still stuck?
Contact support with your Home Assistant version and whether the curl check in step 2 worked — those two facts identify the cause almost every time. Feedback sent from inside the app (Settings › Feedback) includes your app version automatically; add an email if you'd like a reply.