# Is it possibly to make an apple shortcut, that reads a NFC tag, and start a homey flow by sending the value inside the flow **URL:** \ **Category:** Questions & Help\ **Created:** [December 12, 2024, 7:55am UTC](https://community.homey.app/t/is-it-possibly-to-make-an-apple-shortcut-that-reads-a-nfc-tag-and-start-a-homey-flow-by-sending-the-value-inside-the-flow/123721 "2024-12-12T07:55:07Z")\ **Posts on this page:** 11\ **Page:** 1
**Author:** ![Michael\_Nielsen1](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/michael_nielsen1/32/120558_2.png) [@Michael\_Nielsen1](https://community.homey.app/u/Michael_Nielsen1)\ **Post date:** [December 12, 2024, 7:55am UTC](https://community.homey.app/t/is-it-possibly-to-make-an-apple-shortcut-that-reads-a-nfc-tag-and-start-a-homey-flow-by-sending-the-value-inside-the-flow/123721/1 "2024-12-12T07:55:07Z")
I would like to use my iphone reading a NFC tag, and sending the NFC value to a homey flow, so i can make the Flow to different things depending of the NFC tag value. ---
**Author:** ![Nick11](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/nick11/32/120935_2.png) [@Nick11](https://community.homey.app/u/Nick11)\ **Post date:** [December 12, 2024, 10:09am UTC](https://community.homey.app/t/is-it-possibly-to-make-an-apple-shortcut-that-reads-a-nfc-tag-and-start-a-homey-flow-by-sending-the-value-inside-the-flow/123721/2 "2024-12-12T10:09:37Z")
Hi, yes, I would suggest using the iphone app “shortcuts” and homey webhooks for this (they are default on). ### Steps: 1. **Create a Homey Flow with Webhook Trigger** : - Open the Homey app. - Go to **Flows** and create a new flow. - Add the “When” card: **Webhook received**. - Name the webhook, e.g., `nfc_tag`. - Add “Then” actions based on the NFC tag value, such as turning on lights or setting specific actions. 1. **Read NFC Tag with iPhone** : - Use the **Shortcuts** app: - Create a new Shortcut. - Add the “NFC” action and scan your NFC tag to associate it with the Shortcut. - Add the “Get Contents of URL” action in the Shortcut to send a webhook request. - Use the URL format: ```auto https://webhook.homey.app/[yourcloudid]/nfc_tag?tag=front_door ``` Replace `[yourcloudid]` with your Homey Cloud ID, you can find it in the url when you go to [https://my.homey.app/](https://my.homey.app/) You can either use a different webhook for each NFC-Tag, or use different “tag=” for each. The `tag` parameter is automatically captured as a variable in the Flow: Add a “And” condition to check the value of the `tag` parameter: - Choose **Logic \> Is exactly**. - Set the variable to `tag` (it will be available automatically). - Enter the specific value to match (e.g., `front_door`). ---
**Author:** ![Nick11](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/nick11/32/120935_2.png) [@Nick11](https://community.homey.app/u/Nick11)\ **Post date:** [December 12, 2024, 10:17am UTC](https://community.homey.app/t/is-it-possibly-to-make-an-apple-shortcut-that-reads-a-nfc-tag-and-start-a-homey-flow-by-sending-the-value-inside-the-flow/123721/3 "2024-12-12T10:17:18Z")
Sorry, need to ask now a question on my own, @homey team: I’ve just tested this on my own. I am not sure if it is a good idea, because the webhooks are acutally public accessible. Meaning if someone gets the knowledge of your webhook, he can just trigger it without having to login. So make sure you do not trigger any crutial stuff with that… To make it more safe I would suggest using only the local URL (by using your homey’s IP as address). But then you would need to turn off the webhook capabilty as you can not distinguish between local calls and calls from the web inside a flow. ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [December 12, 2024, 10:41am UTC](https://community.homey.app/t/is-it-possibly-to-make-an-apple-shortcut-that-reads-a-nfc-tag-and-start-a-homey-flow-by-sending-the-value-inside-the-flow/123721/4 "2024-12-12T10:41:25Z")
I think the main point is “sending the NFC value to a homey flow”, which (AFAIK) isn’t possible. ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [December 12, 2024, 10:46am UTC](https://community.homey.app/t/is-it-possibly-to-make-an-apple-shortcut-that-reads-a-nfc-tag-and-start-a-homey-flow-by-sending-the-value-inside-the-flow/123721/5 "2024-12-12T10:46:25Z")
> [@Nick11](#): > > Meaning if someone gets the knowledge of your webhook, he can just trigger it without having to login. Athom apparently assumes that MongoDB ObjectId’s, which are used as `cloudId`, are random and/or safe to use as a secret, neither of which is true. I remember trying to discuss this years ago, and Athom simply didn’t care 🤷🏼‍♂️ ---
**Author:** ![Nick11](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/nick11/32/120935_2.png) [@Nick11](https://community.homey.app/u/Nick11)\ **Post date:** [December 12, 2024, 11:05am UTC](https://community.homey.app/t/is-it-possibly-to-make-an-apple-shortcut-that-reads-a-nfc-tag-and-start-a-homey-flow-by-sending-the-value-inside-the-flow/123721/6 "2024-12-12T11:05:27Z")
beside the discussion if they are “safe” as they are long enough and random: You don’t have to guess them. Anyone in the network path of the request can read them as they are contained within the URL. Just sniff the traffic and you get any URL even if the request itself is https. So yes, using webhook are completly insecure and you should only use it for stuff where you don’t care if someone else is accessing it. The community app “webhooks” together with using some token in the request header or body (which is encrypted in https) would make it safe, but a bit harder to configure. Add a field “token” to the request header in the shortcuts app with a token only you know (use random 64 caracters for example), and read it out add additional “when” in the flow using the app “webhooks”. ---
**Author:** ![Peter\_Kawa](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/peter_kawa/32/173848_2.png) [@Peter\_Kawa](https://community.homey.app/u/Peter_Kawa)\ **Post date:** [December 13, 2024, 12:01am UTC](https://community.homey.app/t/is-it-possibly-to-make-an-apple-shortcut-that-reads-a-nfc-tag-and-start-a-homey-flow-by-sending-the-value-inside-the-flow/123721/7 "2024-12-13T00:01:29Z")
TS can use local webhooks, when the “NFC phone” is part of the same subnet as Homey during the procedure. > [@Webhook vom Smartphone an Homey schicken](https://community.homey.app/t/webhook-vom-smartphone-an-homey-schicken/90371/4): > > **Pro 2023:** > > `http:///webhook?event=my_event&tag=my_tag` > > **Pro 2019:** > > `http:///api/manager/logic/webhook/my_event?tag=my_tag` ---
**Author:** ![Vnet](https://avatars.discourse-cdn.com/v4/letter/v/d78d45/32.png) [@Vnet](https://community.homey.app/u/Vnet)\ **Post date:** [December 13, 2024, 6:06am UTC](https://community.homey.app/t/is-it-possibly-to-make-an-apple-shortcut-that-reads-a-nfc-tag-and-start-a-homey-flow-by-sending-the-value-inside-the-flow/123721/8 "2024-12-13T06:06:48Z")
I use webhook relays (azure) in series. Traffic between them and homey is https. Traffic between iphone (or other systems like shelly) and the whrelay is https and use ‘post’ method. the post body payload contains extra credentials which webhook relay authenticates before transforming to the ‘get’ method and relaying the modified payload to homey. The wh relay itself besides the extra authentication, checks on sender (app) type and blocks unknown http endpoints This means that the real homey url is never used on an end user device. Still experimenting with extra certificates. ---
**Author:** ![Nick11](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/nick11/32/120935_2.png) [@Nick11](https://community.homey.app/u/Nick11)\ **Post date:** [December 13, 2024, 7:04am UTC](https://community.homey.app/t/is-it-possibly-to-make-an-apple-shortcut-that-reads-a-nfc-tag-and-start-a-homey-flow-by-sending-the-value-inside-the-flow/123721/9 "2024-12-13T07:04:39Z")
And how do you block homey from direct access via the normal webhooks? ---
**Author:** ![Vnet](https://avatars.discourse-cdn.com/v4/letter/v/d78d45/32.png) [@Vnet](https://community.homey.app/u/Vnet)\ **Post date:** [December 13, 2024, 11:17am UTC](https://community.homey.app/t/is-it-possibly-to-make-an-apple-shortcut-that-reads-a-nfc-tag-and-start-a-homey-flow-by-sending-the-value-inside-the-flow/123721/10 "2024-12-13T11:17:49Z")
The webhook is flowing via vpn tunnel to firewall and from there to homey. The fw only accepts webhooks from relay, the rest is dropped. But indeed, if you do not have the possibility to have the homey behind a fw or you are using homey cloud then if someone knows the homey webhook id then you can have a security breach. With https, everything is tls encrypted except the domain name. So everything after webhook.homey.app (the id and event code) cannot be seen by the man in the middle. But as the id cannot be changed, it is wise to still use a trusted webhook relay as a public webhook endpoint Also, do not use browsers to send the webhook as the complete url including id is cached in this browser. ---
**Author:** ![Nick11](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/nick11/32/120935_2.png) [@Nick11](https://community.homey.app/u/Nick11)\ **Post date:** [February 13, 2025, 7:09pm UTC](https://community.homey.app/t/is-it-possibly-to-make-an-apple-shortcut-that-reads-a-nfc-tag-and-start-a-homey-flow-by-sending-the-value-inside-the-flow/123721/11 "2025-02-13T19:09:27Z")
Oh wow, I did not know that. Somehoe I always assumed that the full url is transferred unencrypted. Ok, made my apps more secure than needed 🤣. Never too old to learn something I assume.