Skip to Content

The upgrade that makes all seven of your API keys disappear

Pi Agent puts out a release almost every month, and nearly all of them you can simply install. Version 0.13.0 is the exception. It moved every API key field out of the add-on and carried nothing across, so what you meet
September 12, 2026 by
The upgrade that makes all seven of your API keys disappear
OdooBot
one release that bites
Pi Agent Guide · Part 15

The upgrade that makes all seven of your API keys disappear

Pi Agent puts out a release almost every month, and nearly all of them you can simply install. Version 0.13.0 is the exception. It moved every API key field out of the add-on and carried nothing across, so what you meet afterward is 401 errors everywhere. This article is the routine that makes that harmless: what to copy before you press Update, the seven steps, the check afterward, and the way back.

7 fields
Password boxes that left the Configuration tab in v0.13.0
Nothing migrated
The CHANGELOG calls it a hard cut. It means it.
10-30 minutes
The whole upgrade, first time versus fifth
Why this one is different

Most releases you just install. One you do not.

Pi Agent went from 0.1.0 to 0.13.1 in about six months, across more than twenty releases. Almost all were repairs you never had to think about: nginx behaving better behind Ingress, clearer log messages. Install, carry on.

Every so often, though, a release changes something you set up. That is a breaking change, and the biggest so far is v0.13.0.

In plain terms

The version number tells you how much care to take. 0.13.0 to 0.13.1 changes the last digit — a repair. 0.12.x to 0.13.x changes the middle one, and in software still in its 0.x years that is where the furniture gets moved. Pi Agent has not reached 1.0. When the middle number moves, read the notes first.

Three habits carry you through any release, and this article is built around them. Back up and copy your keys before touching Update. Read the release notes for Breaking and Migration. Know the way back before you need it.

Installed Pi Agent recently? Then you are already on 0.13.x or later and this migration is behind you. Read on anyway: the next breaking change will be a variation on the same theme, and the checklist below is the part you reuse.
Where the keys went

Seven password fields, moved without a forwarding address

Up to v0.12.x, Add-on → Pi Agent → Configuration showed seven password fields, one per provider: GLM, MiniMax, OpenAI, OpenRouter, Anthropic, DeepSeek and Groq. You pasted the keys there, selected Save, and restarted. At startup pi-web wrote them into /data/pi-agent/models.json, and chat worked.

From v0.13.0 the group is gone. Four container-level options sit there instead:

OptionWhat it doesDefault
log_levelLog verbosity: error / warn / info / debuginfo
timezoneAn IANA time-zone name, such as Asia/TaipeiEmpty, meaning UTC
reset_video_toolsReinstalls the video tooling at the next start, repeating the 720 MB downloadfalse
env_varsAdvanced environment variables — proxies, mirrors and similar[]

The keys now live in one place: the Models panel inside pi-web, the same screen you used in Part 3.

In plain terms

Two people were writing on the same shopping list. You add a provider in pi-web; the next restart rewrites the list from the Configuration tab, and your entry is gone because it was not on their copy. v0.13.0 takes the pen away from one of them.

flowchart TD
  A["Configuration tab
seven password fields"] --> C["/data/pi-agent/models.json"] B["Models panel in pi-web"] --> C C --> D["Two writers, one file.
A provider added in pi-web could be
removed on the next restart."] D --> E["v0.13.0 stops the Configuration tab
writing this file at all"] E --> F["One writer, no overwriting — and
no path for your old keys to travel"]
Why the change was madeOne interface now owns the file. The cost of that tidy-up is that the old route no longer exists to carry your values over.

There is no automatic migration. The CHANGELOG does not soften it: no auto-migration; hard cut. Your old models.json is still on disk, but the placeholders inside it — "$GLM_API_KEY" and its six siblings — now resolve to empty strings. Every request returns 401 until you enter the keys again. That is the expected state, not a fault.

Copy your keys before you press Update. Those fields vanish with the upgrade, so you cannot go back for a value you forgot. Lose one and your only option is a new key from the provider.
The Configuration tab of the Woow HA Pi Agent add-on in Home Assistant, still on the old release. The Options form lists seven fields in order: api_key, minimax_api_key, openai_api_key and openrouter_api_key, each holding a value shown as a row of dots with an eye icon beside it, then anthropic_api_key, deepseek_api_key and groq_api_key, which are empty.
The Configuration tab, before the upgradeThe seven key fields v0.13.0 removes. Reach it from Add-on → Pi Agent → Configuration.
  • Seven fields, one per providerapi_key, minimax_api_key, openai_api_key, openrouter_api_key, anthropic_api_key, deepseek_api_key, groq_api_key. This is the group that disappears.
  • The eye icon at the right of each row uncovers a stored value. That is how you copy a key out before you upgrade, and it is the step nothing substitutes for.
  • Four are filled, three are empty here, which is normal — you only fill in the providers you actually use. Copy the filled ones; there is nothing to copy from the rest.
The seven steps

Upgrading from v0.12.x to v0.13.x, in order

In plain terms

Step 1 is the photograph you take of the wiring before you unscrew the socket. Boring, two minutes, and the only reason a bad outcome stays a small one.

  1. Step 1

    Create a Home Assistant backup

    Go to Settings → System → Backups → Create backup. Choose a full backup, or at minimum include the Pi Agent add-on. Name it something you will recognize later, such as pre_pi_agent_0.13.0. Usually 1-3 minutes, and it is your recovery point.

  2. Step 2

    Copy every API key into a password manager

    Open Add-on → Pi Agent → Configuration. Reveal and copy every *_api_key field that has a value in it. After the upgrade, this is your only way back to those values.

  3. Step 3

    Select Update on the Info page

    Open Add-on → Pi Agent → Info. The new version number and the Update button are at the top. Supervisor downloads the new image and restarts the container, usually in 2-5 minutes. A stream of messages on the Log tab is normal.

  4. Step 4

    Check the log for a clean start

    A line reading pi-web listening on :30141 means pi-web is running. You will probably also see 401 warnings, because the keys are now empty. At this exact moment those warnings are correct.

  5. Step 5

    Re-enter each key in the Models panel

    Open Pi Agent from the sidebar, then the Models tab. Each provider's API Key field will be empty or marked “Not set.” Select Edit, paste the key, select Test, wait for the green check, then Save. Repeat for every provider you use.

  6. Step 6

    Send one message to prove it

    Start a new session, pick a provider, and send “Hello.” A normal reply means both halves worked — upgrade and keys. Sessions from before should still be in the list.

  7. Step 7

    Set your time zone while you are here

    Back on Add-on → Configuration, set timezone to your IANA identifier — for Taiwan, Asia/Taipei. It lines log timestamps up with your clock. Leave the other three alone.

The Info page of the Woow HA Pi Agent add-on in Home Assistant. Under the title it reads Current version: 0.12.0 with a Changelog link, beside a green Rating badge and a blue Ingress badge. Four toggles follow — Start on boot on, Watchdog on, Autoupdate off, Add to sidebar on — with Hostname, Add-on CPU usage 0% and Add-on RAM usage 0% in the right-hand column, and Stop, Restart, Uninstall and Open web UI along the bottom.
Step 3 starts hereThe Info page on 0.12.0 — the version this migration starts from.
  • Current version: 0.12.0 sits under the title and tells you which side of the migration you are on. On 0.12.0, as here, the seven key fields are still waiting on the Configuration tab.
  • Changelog is a link, right beside the version number. It opens the file the last section of this article asks you to read.
  • Autoupdate is the third of the four toggles, and it is off in this screenshot. Leave it that way; the last section explains why.
How long this really takes: about ten minutes once you have done it before, up to half an hour the first time. Most of the difference is hunting for keys you never saved.
The three-minute check

Five things to look at after any upgrade

Run this after every release, breaking or not. It catches problems now rather than in the middle of something that matters.

  • The sidebar button. Refresh Home Assistant. Pi Agent should still be in the left sidebar.
  • The providers. Open Models. Every provider you configured should still be listed, and Test should go green on each. A red cross usually means an invalid key.
  • Your conversations. Check the Sessions list. Old conversations should be there and should still open. If any are missing, restore the backup.
  • Your Skills. Open Skills. Everything installed before should still be listed.
  • One new message. New session, pick a provider, say hello. A reply within about three seconds is the test.

If that last one fails, the error code points the way: 401 means the key is missing or wrong, a timeout suggests provider congestion or a dropped VPN, and 404 usually means a model name that no longer exists.

Otherwise, match the symptom to the release behind it:

SymptomWhich releaseWhat to do
Every message returns 401 After upgrading to v0.13.0 The keys were never re-entered in Models. Step 5 above — about five minutes if they are in your password manager.
Video features error, chat feels slow After v0.11.0 or v0.13.0 video-tools-init is still fetching roughly 720 MB of Chromium and Python environment. Watch the Log tab and wait for its completion line.
If the update itself looks stuck, do not restart Home Assistant. The image carries Chromium and ffmpeg, so a first download can take 5-10 minutes, or 15 on a slow connection. After twenty minutes with no progress, read the log for the first Error line — the first one, not the cascade under it.
Going back

There is no rollback button, so there is a backup

Pi Agent has no one-click revert — true of Home Assistant add-ons generally, not a gap in this one. It leaves two routes back.

The standard route: restore the backup

Go to Settings → System → Backups and find the one from step 1. Select Restore, choose to restore only the Pi Agent add-on, and wait 3-5 minutes while Supervisor reinstalls the old image and puts back the earlier /data/pi-agent/. You land where you were: version, keys, Sessions, Skills.

Restoring is all-or-nothing for the add-on. You cannot pick individual Sessions or keys out of a backup, and anything created since the upgrade goes with the restore. If new conversations matter, copy their .jsonl files out of /data/pi-agent/sessions/ first — to somewhere like /config/backup_sessions/ — then copy them back afterward and restart the add-on.

The advanced route, and why it is second

The three-dot menu on the Info page may offer Install a specific version, where you name an older tag such as 0.12.0. Some Home Assistant versions show it only with Advanced Mode on. The catch: your /data/pi-agent/ stays as the newer release left it, and an older release may not read the newer models.json schema. If in doubt, restore the backup.

Whichever route you take, check Autoupdate is off before you walk away. Otherwise you do all of this again by accident in a few days.

Notes, and auto update

Three minutes of reading, once a month

Every release records what changed, and whether anything breaks, in one file on GitHub:

https://github.com/WOOWTECH/Woow_ha_pi_agent_add_on/blob/main/CHANGELOG.md

You do not need to know GitHub to read it. Open the address; the newest release sits at the top. You are scanning for five words:

KeywordWhat it meansWhat to do
BREAKINGThe release changes settings or behavior you already haveStop. Read the whole entry, back up, then upgrade.
MigrationSomething has to be moved by handFollow the documented steps, or the procedure above.
FixA bug is repairedIs it a bug you have? If so, upgrade promptly.
Add / NewA feature arrivesDo you want it? If not, wait a week.
Deprecated / RemovedOn its way out, or already goneIf you use it, read what replaces it.

The v0.13.0 entry shows how readable this is. Its first line: “BREAKING: AI provider API keys moved out of the addon Configuration tab into the pi-web UI.” Further down: “Migration: after upgrade, open pi-web and re-enter each key inside the Models panel.” Most of this article is in those two sentences.

flowchart TD
  A["A new release appears"] --> B{"Does the entry say
BREAKING or Migration?"} B -->|"yes"| C["Back up, copy your keys,
read the whole entry"] B -->|"no"| D{"Does it fix something
that is blocking you?"} C --> E["Install it, then run
the three-minute check"] D -->|"yes"| E D -->|"no"| F["Wait a week; let early adopters
find the rough edges"]
What to do when an update appearsOnly one path goes straight to Update: the one where you already know what the release fixes.
In plain terms

Autoupdate is the difference between a parcel left on the doorstep and one you sign for. Both arrive. Only one tells you it arrived, on a day when you have time to deal with what is inside.

For a 0.x add-on moving this fast, leave Autoupdate off. Three reasons:

  • It skips your backup. Supervisor installs as soon as it sees a release. It never pauses to remind you to make a recovery point.
  • It cannot do a migration. Nothing automated copies your keys into the Models panel. You meet the change as a screen full of 401s one morning, days after it happened.
  • Fresh releases have rough edges. Waiting a week lets others find them and the maintainer publish an x.y.1 — as v0.13.1 did for the 413 upload problem.

Instead, look at the add-on page once a week, or on a free weekend. About once a month you will install what has piled up; make the backup the same day and the two become one habit. If you look after Home Assistant in two houses, upgrade them a week apart, so a bad release still leaves you one working system.

My version works. Do I have to install every release?
No, but do not let breaking ones stack up. Install bug fixes that affect you, take features when you want them, and plan migrations early. v0.12.x to v0.13.x is one migration. Waiting until v0.15.x could mean three at once.
I re-entered the keys and still get 401
Three usual causes. A stray space or line break came along with the key — copy it again cleanly. Or a key went in under the wrong provider; keys are provider-specific, and a GLM key under OpenAI fails exactly like an invalid one. Or the model name changed and your account no longer has that variant, which shows as 404 more often. Part 16 covers the error codes properly.
Next

Where to go from here

keep going

The upgrade is clean. Now for when something is not.

Part 16 is the troubleshooting guide: the error codes you will actually meet, Ingress problems, video pipeline stalls and Skill installs that refuse. Have it open when a symptom matches nothing in the table above.

Open the full guide

Part 15 of the Pi Agent Onboarding Guide series, published by WoowTech.

Based on the Woow HA Pi Agent Onboarding Guide, produced by WoowTech and released under CC BY 4.0.

The Smart Space Solution · 智慧空間解決方案 · © 2026 WOOW Technology Co., Ltd.

Share this post