diff --git a/.gitignore b/.gitignore
index e1f134f..5c3901e 100644
--- a/.gitignore
+++ b/.gitignore
@@ -9,3 +9,7 @@ package-lock.json
 .commitinfo
 .claude/settings.local.json
 
+
+
+# ioBroker dev-server
+.dev-server/
diff --git a/README.md b/README.md
index d0eb1b6..688a5b5 100644
--- a/README.md
+++ b/README.md
@@ -106,6 +106,10 @@ Please check it https://www.smarthomejetzt.de/mit-iobroker-auf-eine-home-assista
 -->
 
 ## Changelog
+### **WORK IN PROGRESS**
+* (@klein0r) Use /core/ instead of /api/ when connecting to supervisor directly (e.g. in ha app)
+* (@klein0r) Use ENV var SUPERVISOR_TOKEN as fallback for password
+
 ### 2.0.4 (2026-05-05)
 * (@GermanBluefox) Tried to keep the custom settings of the objects when updating them with new data from HASS
 
diff --git a/admin/hass.png b/admin/hass.png
index f7e5789..6f61d5a 100644
Binary files a/admin/hass.png and b/admin/hass.png differ
diff --git a/src/lib/hass.ts b/src/lib/hass.ts
index 21ed9f5..7d949ff 100644
--- a/src/lib/hass.ts
+++ b/src/lib/hass.ts
@@ -108,11 +108,12 @@ export default class HASS extends EventEmitter {
                     this.emit('state_changed', response.event.data.new_state);
                 }
             } else if (response.type === 'auth_required') {
-                if (!this.options.password) {
+                const password = this.options.password || process.env.SUPERVISOR_TOKEN;
+                if (!password) {
                     this.emit('error', 'Password required. Connection closed');
                     socket.terminate();
                 } else {
-                    setTimeout(() => this.sendAuth(socket, this.options.password!), 50);
+                    setTimeout(() => this.sendAuth(socket, password), 50);
                 }
             } else if (response.type === 'auth_ok') {
                 setImmediate(() =>
@@ -228,7 +229,7 @@ export default class HASS extends EventEmitter {
         }
 
         this.socket = new WebSocket(
-            `ws${this.options.secure ? 's' : ''}://${this.options.host}:${this.options.port}/api/websocket`,
+            `ws${this.options.secure ? 's' : ''}://${this.options.host}:${this.options.port}/${this.options.host === 'supervisor' ? 'core' : 'api'}/websocket`,
             { perMessageDeflate: false },
         );