Dashboards & browser

Everything on this page lives under Settings, Dashboard. It applies when Kiosk mode, Show is set to Browser (the default). For single-app mode see Choosing a mode.

The start URL#

The Dashboard card holds the first dashboard, which is named Home:

Tap Save dashboard to apply. The Reload command and the Home Assistant Reload button do the same on demand.

Allowed hosts#

Kiosky only navigates to hosts it trusts: the host of each dashboard URL (any port) plus your extra allowed hosts. Everything else, other schemes included, is blocked. The same list gates the load_url and popup commands and sound URLs for play.

An allowed-host entry is one of:

If a dashboard redirects through another host (a login page, a CDN), add that host here. The setup wizard adds a redirect target for you when it sees one.

Multiple dashboards#

More dashboards adds extra named dashboards beside Home. Enter a Name (up to 64 characters, unique ignoring case) and a URL, then Add dashboard. Remove deletes one.

With two or more dashboards you can:

• Swipe between dashboards: switch on under Navigation and swipe in from the left or right screen edge.
• Show a home button: a floating button that returns to the first dashboard.
• Switch by command: the dashboard command, or the Dashboard select entity in Home Assistant. See Home Assistant integration.
• Rotate or schedule them, below.

Note. Dashboard rotation and the planner are listed among the candidate Pro features in the app. While Kiosky Pro is in development every feature is unlocked. See Kiosky Pro.

Rotation#

Dashboard rotation cycles dashboards while the screen is on and untouched. Turn on Rotate dashboards, then set:

Planner#

The Dashboard planner shows a dashboard during a daily window. Add up to 24 rules, each with a dashboard, From and To times (HH:mm, the window may cross midnight) and the weekdays on which the window starts. The first matching rule wins.

Priority, from highest: the night page (see Screen, power & screensaver), then planner rules, then rotation. A manual switch (a swipe or a command) holds until the next rule starts or ends.

Page display and navigation#

Home Assistant#

Under Home Assistant sign-in, enter your Home Assistant address (for example http://homeassistant.local:8123) and a Long-lived access token, then Save sign-in. Create the token in Home Assistant under your profile, Security, Long-lived access tokens.

• The dashboard logs in without the login screen. The token is stored encrypted and is only given to the address you entered.
• A saved token shows "A token is saved. Leave blank to keep it." Remove token deletes it.
• Changing the address to a different origin removes the stored token, so a token can never be sent to a new server by accident.
• A token is not sent to a plain http:// address that is not on your local network. Use https:// for public addresses.
• The same token powers camera popups and voice. See Camera & sensors and Home Assistant integration.

Home Assistant theme#

Home Assistant theme on this tablet sets an HA theme for this tablet only. Enter a theme name such as Graphite (blank keeps HA's default), choose Light or dark (Auto follows the tablet's setting), and tap Save theme.

Hiding the Home Assistant header and sidebar#

Under Custom CSS and JavaScript, Hide Home Assistant chrome is built in and needs no HACS card. Choose:

• Show: nothing is hidden.
• Hide header: hides HA's top bar and keeps the sidebar for navigation.
• Hide both: hides the header and the sidebar.

To bring the hidden parts back, double-tap within the top 48 pixels of the screen. They reappear for 15 seconds and then hide again. The revealing tap is swallowed so it cannot press whatever appears underneath.

The preset applies to your Home Assistant address. It works by editing HA's page styles, so a major change to the HA frontend can break it. If that happens, switch to Show.

Custom CSS and JavaScript#

Add your own rules under Custom CSS and JavaScript: a URL pattern (for example ha.local:8123/*, where * matches any run of characters), CSS and JavaScript, then Add rule. You can have up to 20 rules, each part up to 20,000 characters. Rules run on matching pages only.

Warning. Injected scripts run inside your pages with full access to them. Only add code you trust. Over the network, changing injection rules is a protected change, see Security.

Web access: the JavaScript bridge, microphone and camera#

Under Web access you list origins (scheme, host and port, such as http://ha.local:8123), comma separated:

• JS bridge origins: pages from these origins get a window.kiosk object. Leave empty to turn the bridge off.
• Microphone / camera origins: pages from these origins may use the microphone or camera. They also need https. Leave empty to deny.

The bridge returns promises:

// Read a limited device state: screen, screen_stage, brightness, battery,
// charging, light_lux, dashboard, volume, app_version (no IP, SSID or URLs)
const state = await window.kiosk.getState();

// Run a command a page is allowed to run
await window.kiosk.command("toast", { text: "Hello from the page", duration: 5 });

// Listen for events such as popup_shown
window.kiosk.onEvent((event) => console.log(event));

A page can only run reload, load_url, dashboard, screen, brightness, screensaver, tts, play, stop_audio, volume, toast, popup and dismiss_popup. Reboot, restart, cache clearing and snapshots are never available to pages, whatever your remote-control settings say.