diff --git a/roles/homeassistant/files/auth-command.sh b/roles/homeassistant/files/auth-command.sh
index 4e8f370..6b2c2dc 100755
--- a/roles/homeassistant/files/auth-command.sh
+++ b/roles/homeassistant/files/auth-command.sh
@@ -2,6 +2,10 @@
 
 set -eu
 
+if [ "$(echo "$username" | sed -r 's/^[a-z]+$/x/')" != "x" ]; then
+    exit 2
+fi
+
 curl -sf -X POST -H "Content-Type: application/json" -d @- \
     https://id.foo.sh/authcheck <<EOF
 {"username": "${username}", "password": "${password}", "group": "foosh"}