To enable accessory control Homebridge must be running in insecure mode.

Insecure mode, as it's name suggests, is not secure. Anyone with network access to your Homebridge server port and pin will be able to control your accessories. Unless exposing the Homebridge port to the internet, this will generally not be a problem as access will be limited to people already on your local network. Remote access via a home hub (Apple TV, iPad, HomePod etc.) will still be secure. Enable at your own risk.

In most cases, you can toggle "Insecure Mode" via the Homebridge UI interface, upper top right drop down menu -> Homebridge Settings. If the option is not available, see below for more options.

Add the -I flag:

homebridge -I

If you already have a homebridge running via a pm2 task, stop it by running

pm2 stop homebridge

You must then delete your existing homebridge pm2 task, run

pm2 delete homebridge

Now that the old task is removed, run the below task to start homebridge via pm2 in insecure mode.

pm2 start homebridge -- -I

Configurations that use other process supervisors such as init.d, pm2 or screen can also enable insecure mode just by adding -I to the startup command.