The Short Answer: Apple and Home Assistant Use Different Paths

If Apple Home can pair the accessory but Home Assistant reports a PASE timeout, first generate a new sharing code from the working Apple Home setup and add it through Home Assistant's “already in use” flow. If that fresh attempt reaches the same timeout, read the Matter Server log and then check local IPv6—the inside-the-house network addressing Matter uses. Matter is the cross-brand smart-home standard behind this pairing process.

Apple Home succeeding is useful evidence. It shows the accessory can enter commissioning mode and complete setup with Apple's controller. It does not show that Home Assistant's separate controller has the same network reachability, receives the same local discovery traffic, or is using an open multi-admin window.

This matters most with a HomePod mini or Apple TV acting as the border router for Thread—the low-power mesh network used by many battery devices—or with Home Assistant running in a virtual machine or container. Separating the phone, server, and border router across main, guest, and IoT networks can also block the path. The same error can happen with Matter-over-Wi-Fi, so do not blame Thread just because the log says PASE.

What a PASE Timeout Actually Means

PASE stands for Passcode Authenticated Session Establishment. In plain English, the new controller and accessory use the setup code to begin a protected conversation. That happens after the controller discovers a commissionable accessory and before it can finish adding its own Matter credentials.

On the retired Python-based server, a log such as PASESession timed out while waiting for a response from the peer meant that protected conversation did not complete. The current matter.js server may instead show a SC/PbkdfParamRequest followed by retries. Some older logs say they expected message type 33. That number identifies the first secure-channel response; it is not an error code tied to a particular plug, lock, or sensor.

PASE is a location in the commissioning sequence, not a diagnosis. A closed sharing window, stale code, unreachable IPv6 address, blocked packets, sleepy or buggy accessory, or controller regression can all end at the same stage.

Use the Last Log Message to Choose the Right Fix

Several Matter failures look identical in the phone app. The last meaningful server message tells you where to spend your time.

What you seeWhat completedCheck nextDo not assume
No new Matter Server commissioning entryThe handoff may not have reached the serverCompanion app update and permissions, Matter integration, correct “already in use” flowThat IPv6 or Thread already failed
PASESession timed out or repeated secure-channel requestDiscovery began and a secure setup exchange was attemptedFresh sharing window and code, then Home Assistant-to-accessory local IPv6 reachabilityOne universal network fix
“Checking network connectivity”The phone has progressed into the later network handoffWi-Fi credentials, Thread dataset, preferred network, and local handoff pathThat this is the same PASE-stage failure
“Fabric already exists”The device remembers an earlier saved relationship with that controllerRemove only the stale Home Assistant service, then reopen sharingThat all Apple Home data must be erased
Device adds, then becomes unavailableCommissioning completedOperational IPv6, Thread routing, multicast discovery, and controller recoveryThat the pairing code is still the issue

Fix a Home Assistant Matter PASE Timeout in This Order

1. Update the Supported Matter Path

Update Home Assistant Core, the Home Assistant Companion app on the phone, and the official Matter Server app. Home Assistant released Matter Server 9.0 in June 2026 as a drop-in migration from the older Python server to matter.js, with commissioning and recovery changes. Use the current stable release; a timeout alone is not a reason to join a beta.

Home Assistant OS with the official Matter Server app is the supported installation. A self-managed Matter Server container can work locally, but Home Assistant documents it as an advanced, unsupported path. If you use it, its host networking and IPv6 are part of the system you must troubleshoot.

2. Open a Fresh Apple Home Sharing Window

If the device already works in Apple Home, leave it there. Start Home Assistant's existing-device flow and follow the Apple handoff. If Apple Home shows Turn On Pairing Mode or a connect-another-service option for the accessory, use it and copy the newly generated Matter code. Use that code promptly while the temporary window is open.

In the Home Assistant Companion app, go to Settings → Matter → Add device. Select Yes, it's already in use, choose Apple Home, and follow the prompts. Do not treat the printed QR code as the sharing code after the device has already joined Apple Home. The new window is what authorizes another controller.

If the device exposes sharing through its manufacturer's app instead of Apple Home, use that documented control. The principle is the same: request a new commissioning window from the controller that already owns the device.

3. Watch One Commissioning Attempt in the Matter Server Log

Open the Matter Server app log, start one fresh sharing attempt, and note the last repeated line. Do this before restarting or resetting anything; otherwise the most useful evidence disappears into a pile of unrelated recovery messages.

  • No commissioning start: stay with the phone-to-Home Assistant handoff. Confirm the current Companion app, Matter integration, phone permissions, and correct Home Assistant server connection.
  • Discovery plus PASE retries: the request reached Matter Server. Recheck the fresh code and window, then follow the IPv6 path from that server to the address shown in the log.
  • Commissioning moves beyond PASE: stop applying PASE fixes. Use the later message to follow network handoff, certificate, fabric, or operational-connectivity troubleshooting.

4. Run a Controlled Simple-LAN Test

For one retry, put the phone and Home Assistant on the normal home network and keep the active Wi-Fi access point and Thread border router on an unfiltered path to it. Temporarily bypass a guest Wi-Fi network, device isolation, multicast filtering, and rules between VLANs—separate network segments often used for IoT devices. This is a diagnostic test, not advice to abandon segmentation permanently.

If that works, restore separation one boundary at a time. Matter uses local IPv6 and local device-discovery announcements. A router feature that forwards only some of those announcements between separate networks may not be enough. Check IPv6 routing, local device discovery, wireless client isolation, and any router feature that filters traffic between Wi-Fi and Ethernet.

Do not leave the whole firewall disabled. Record which network boundary made the retry fail, restore the firewall, and use your router's documentation or qualified support to allow only the needed communication inside the home.

5. Check Home Assistant's Local IPv6

You do not need public IPv6 from your internet provider. You do need working IPv6 inside the house. On Home Assistant OS, the current official Thread troubleshooting procedure starts by running ha docker info. If enable_ipv6 is already true, leave it alone and keep tracing the network.

Only if it shows null or false, follow the documented Home Assistant OS step: run ha docker options --enable-ipv6=true, then ha host reboot. If Home Assistant OS runs as a virtual machine, also confirm that the virtual machine's network adapter connects directly to a home network with IPv6. Use the instructions for your virtual-machine software if you are unsure.

For Home Assistant Container, Docker, the host operating system, the virtual network, and the router may each need correct IPv6 handling. There is no safe universal Compose file or sysctl line for every host. Use Home Assistant's requirements plus the documentation or qualified support for your Docker host, virtual-machine software, and router.

6. If It Is Thread, Keep the Working Apple Border Router

A HomePod mini, HomePod (2nd generation), Apple TV 4K (2nd generation), or Apple TV 4K (3rd generation Wi-Fi + Ethernet) can provide the Thread border-router path. Home Assistant can communicate through a third-party border router; the border router routes encrypted IPv6 packets and is not the Matter controller itself.

If Apple Home already controls the Thread accessory, keep that Apple border router powered and on the same reachable local network during the test. Home Assistant does not need a Connect ZBT-1, Connect ZBT-2, Yellow radio, or a second Thread mesh merely to control an accessory already reachable through Apple's border router.

Home Assistant's Thread integration and imported Thread credentials matter when Home Assistant is helping place a new accessory onto a Thread network or managing its own OpenThread border router. They do not repair a blocked IPv6 route by themselves. Avoid creating another preferred Thread network in the middle of this PASE investigation.

7. Remove Only a Stale Home Assistant Service

If a previous attempt partly succeeded, the device may already list Home Assistant as a connected service even though no usable device remains in Home Assistant. Remove that one stale Home Assistant connection from the controller or accessory interface that exposes it, then open a fresh sharing window.

Apple distinguishes removing an accessory from one connected service from removing it from all services. Choose the narrow action. Remove From All Services can erase working control across Apple Home and every other connected platform.

8. Factory-Reset One Accessory Last

Reset only after the current software, fresh sharing window, commissioning log, simple-LAN test, local IPv6, and stale-service check have failed. Start with one low-risk accessory such as a plug or lamp, not every lock, thermostat, blind, and sensor in the house.

A reset may clear stuck setup data inside one device. It cannot fix a Home Assistant host that cannot reach the device's IPv6 address. If Apple Home paired the accessory before and the same Home Assistant path fails after a clean reset, return to the controller and network path.

PASE Can Fail on Matter over Wi-Fi or Thread

PASE belongs to Matter commissioning, not to Thread alone. A Wi-Fi plug and a Thread sensor can both reach this error. The difference is the route after discovery:

  • Matter over Wi-Fi: Home Assistant's Matter Server reaches the accessory through the ordinary Wi-Fi and Ethernet LAN.
  • Matter over Thread: the server reaches the accessory over local IPv6 through a Thread border router such as an Apple HomePod mini or Apple TV 4K.

If both Wi-Fi and Thread Matter devices fail from the same Home Assistant server, inspect the common controller, host, and LAN path before changing Thread radios. If only one Thread device fails while other Thread devices pair normally, its commissioning window, firmware, power, range, or saved controller state becomes more likely.

Which Home Assistant and Apple Paths Are Involved?

These are controller and transport choices, not product rankings. Keep the roles separate while troubleshooting.

Path or deviceOfficial supportLocal controlCloud or account dependencyMatter and HomeKit roleMain caveat
Home Assistant OS + official Matter Server appHome Assistant's supported Matter pathNormal commands stay inside the home and can keep working during an internet outageNo vendor cloud required for normal commandsNative Matter controller; Apple Home can be a second controller through device sharingThe host and home network still need local IPv6
Home Assistant Container + self-managed Matter ServerDocumented as advanced and unsupportedCan remain localNo required cloud, but the operator owns the hostNative Matter controller when correctly networkedDocker, host, VM, and router IPv6 can each break reachability
HomePod mini, HomePod (2nd generation), Apple TV 4K (2nd generation), Apple TV 4K (3rd generation Wi-Fi + Ethernet)Apple-supported Thread home hubs; listed by Home Assistant as known border routersThread routing and in-home control are localApple Home setup and synchronized Matter credentials use an Apple Account and iCloud KeychainApple Home controller plus Thread border router on these modelsApple working does not guarantee Home Assistant's separate IPv6 path
Home Assistant Yellow, Connect ZBT-1, or Connect ZBT-2 running OpenThreadOfficial Home Assistant hardware path; Thread enablement requires documented setupLocal Thread border routingNo required cloud for local routingCan make Home Assistant an OpenThread border routerDo not add one solely because a shared Apple device reports PASE timeout
HomeKit Bridge integrationOfficial Home Assistant integrationLocal bridge from Home Assistant to Apple HomeApple Home account/hub rules apply to the Apple sideExposes Home Assistant entities to Apple Home; it is not the same as adding a Matter device to Home AssistantIt does not fix Matter Server commissioning or PASE

What to Avoid

  • Do not keep reusing the printed QR code after the accessory is already commissioned to Apple Home. Request a fresh multi-admin window.
  • Do not assume Apple success clears the LAN. Each Matter controller must have its own reachable path.
  • Do not add another Thread network as a reflex. More credentials and preferred networks can make the test harder to interpret.
  • Do not paste a random Docker IPv6 recipe. The correct change depends on the host and network mode.
  • Do not remove all connected services when only a stale Home Assistant service needs removal.
  • Do not start with a lock or HVAC controller. Prove the path with a low-risk accessory before disrupting access or comfort.

Tara's Practical Recommendation

Treat this as a three-part handoff: the existing controller opens a fresh window, Home Assistant's Matter Server receives the request, and that server reaches the accessory over local IPv6. Test those parts in that order.

For a homeowner setup, Tara favors Home Assistant OS with the official Matter Server, one intentional Thread network, and a documented border-router owner. Apple Home can remain a second controller. Keep essential automations in one chosen platform so a pairing repair does not create duplicate schedules or two systems fighting over the same lock, light, or thermostat.

FAQ

What does a Matter PASE timeout mean in Home Assistant?

Home Assistant's Matter Server started the passcode-authenticated secure setup conversation but did not complete it. The message identifies the failed stage. It does not by itself identify whether the cause was the commissioning window, passcode, local IPv6 path, filtering, accessory, or controller.

Why can Apple Home pair when Home Assistant cannot?

They are separate Matter controllers. Apple Home can have a working route through its own home hub or Thread border router while Home Assistant's Matter Server has a blocked or incomplete route. Apple also needs to open a new sharing window before Home Assistant can join as another controller.

Should I scan the printed Matter QR code again?

Not when the accessory is already in Apple Home. Open pairing mode or connect-another-service from the current controller and use its new code in Home Assistant's Yes, it's already in use flow.

Do I need another Thread border router?

Usually no. If Apple Home already controls the Thread device, keep its working HomePod or Apple TV border router online. First fix the fresh sharing window and Home Assistant's local IPv6 reachability. A new radio is not a general PASE fix.

Does Matter require IPv6 from my internet provider?

No. Matter needs IPv6 inside the home. Public internet IPv6 is not required, but the Home Assistant host, local network, and Thread border router when present must carry the necessary local IPv6 packets.

Should I factory-reset after a PASE timeout?

Reset last. Update, open a fresh window, read one commissioning log, test a simple LAN, verify local IPv6, and remove only a stale Home Assistant service first. A premature reset can erase a working Apple setup while leaving the actual network fault untouched.