# We could use more scopes **URL:** \ **Category:** Developers\ **Created:** [March 17, 2026, 9:07am UTC](https://community.homey.app/t/we-could-use-more-scopes/152593 "2026-03-17T09:07:11Z")\ **Posts on this page:** 14\ **Page:** 1
**Author:** ![Tim\_Broddin](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/tim_broddin/32/148490_2.png) [@Tim\_Broddin](https://community.homey.app/u/Tim_Broddin)\ **Post date:** [March 17, 2026, 9:07am UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/1 "2026-03-17T09:07:11Z")
Hey team Homey! I love the Homey API! But I would love it even more if some of the scopes currently reserved for the official Homey apps could be made available to us. Some notable omissions in the scopes available for third party devs include moods, and creating/updating (advanced) flows. Do you have adding these on a roadmap? Thanks a lot! ---
**Author:** ![smarthomesven](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/smarthomesven/32/79712_2.png) [@smarthomesven](https://community.homey.app/u/smarthomesven)\ **Post date:** [March 17, 2026, 9:10am UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/2 "2026-03-17T09:10:42Z")
Yes, I’ve posted this before as well. They said that it’s not permitted for security reasons. For now I’m trying to reverse engineer the API from the web app to get access to all features of my Homey Pro 2019. > [@Web API client scopes](https://community.homey.app/t/web-api-client-scopes/146746): > > In the Developer Tools, I can create a API client. However, the scopes it shows are only these: I only see app readonly, and for Flow I don’t see the option to create Flows or Flow folders. And I don’t see dashboards at all, and there is no option to create Zones either. Is there another solution to do this? ---
**Author:** ![Tim\_Broddin](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/tim_broddin/32/148490_2.png) [@Tim\_Broddin](https://community.homey.app/u/Tim_Broddin)\ **Post date:** [March 17, 2026, 9:24am UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/3 "2026-03-17T09:24:04Z")
I get the security implications for things like installing apps (you could easily create a small botnet if tokens leak), but accessing moods and even creating flows seem relatively safe to me. The havoc you can wreak with a leaked key seems to be about the same as with the `homey.device.control` scope 😅 ---
**Author:** ![smarthomesven](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/smarthomesven/32/79712_2.png) [@smarthomesven](https://community.homey.app/u/smarthomesven)\ **Post date:** [March 17, 2026, 9:38am UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/4 "2026-03-17T09:38:02Z")
> [@Tim\_Broddin](#): > > you could easily create a small botnet if tokens leak Did you know Athom doesn’t review the code of community apps? There’s a hidden route (that’s not visible to regular users) in the Homey Developer Tools, which is the page they use for reviewing apps. I couldn’t see anything other than the app manifest there. So I think if someone would really have bad intentions, they would just build an app for something many users asked for. That would be far more effective for attackers than trying to get users to add a malicious OAuth app Edit: something similar has actually happened before (while that was about spamming the timeline): > [@New community store](https://community.homey.app/t/new-community-store/122980/50): > > Let me clarify what happened, before this goes out of hand and everyone keeps speculating slight_smile@Menno_van_Hout requested that his apps be removed from the Homey App Store. While still in talks with employees from Athom, who were very understanding, but also noticed that his main reason was to force people to use his alternative app store, Athom offered to find alternative developers to take over his apps, as we usually do. Menno did not seem to have an interest in that. Then Menno pu… ---
**Author:** ![Tim\_Broddin](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/tim_broddin/32/148490_2.png) [@Tim\_Broddin](https://community.homey.app/u/Tim_Broddin)\ **Post date:** [March 17, 2026, 10:47am UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/5 "2026-03-17T10:47:18Z")
Looking deeper into it, a possible flow could be: ask for OAuth permissions first to resolve the (local/remote) url, and use a locally generated API key for the advanced scopes. This would only work on 2023+, but it’s not too bad as a workaround. ---
**Author:** ![smarthomesven](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/smarthomesven/32/79712_2.png) [@smarthomesven](https://community.homey.app/u/smarthomesven)\ **Post date:** [March 17, 2026, 10:54am UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/6 "2026-03-17T10:54:52Z")
> [@Tim\_Broddin](#): > > and use a locally generated API key for the advanced scopes That won’t work in my case since I have a Pro2019, but if you have a Pro2023 or later then it might work. But I don’t think you can generate a local API key from the cloud API (the official one), for that you’d need to reverse engineer the web app API ---
**Author:** ![Peter\_Kawa](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/peter_kawa/32/173848_2.png) [@Peter\_Kawa](https://community.homey.app/u/Peter_Kawa)\ **Post date:** [March 17, 2026, 5:46pm UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/7 "2026-03-17T17:46:25Z")
> [@Tim\_Broddin](#): > > but accessing moods and even creating flows seem relatively safe to me. Call me blonde, but I don’t understand why AI tools are allowed to set, change and create such things: > [@sparkles Homey MCP Server | Megathread](https://community.homey.app/t/homey-mcp-server-megathread/145181/21): > > . I’m planning to add a few new tools soon. > > - ✅ rename\_device > - ✅ move\_device\_to\_zone > - ✅ get\_standard\_flow > - ✅ create\_standard\_flow > - ✅ update\_standard\_flow > - ✅ get\_advanced\_flow > - ✅ create\_advanced\_flow > - ✅ update\_advanced\_flow > - ✅ get\_flow\_trigger\_cards > - ✅ get\_flow\_condition\_cards > - ✅ get\_flow\_action\_cards > > Let’s hope the LLMs understand these > [@sparkles Homey MCP Server | Megathread](https://community.homey.app/t/homey-mcp-server-megathread/145181/24): > > I’ve just deployed a new version of the Homey MCP Server with those new tools. I managed to create a few Flows & Advanced Flows! > > But, based on your AI agent or Homey, your results might be very different 🙂 > > It’s the cutting edge after all! > > Note: you need to re-authorize to grant your AI agent the new permissions to manage Flows. ---
**Author:** ![smarthomesven](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/smarthomesven/32/79712_2.png) [@smarthomesven](https://community.homey.app/u/smarthomesven)\ **Post date:** [March 17, 2026, 6:08pm UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/8 "2026-03-17T18:08:42Z")
> [@Peter\_Kawa](#): > > but I don’t understand why AI tools are allowed to set, change and create such things: More importantly: why are the AI tools allowed to do that, but other apps aren’t? For an app I’m currently building, I would need at least these permissions: - Create Flows - Update Flows - Get Flows - Create Advanced Flows - Update Advanced Flows - Get Advanced Flows - Create Flow folders - Update Flow folders - Get Flow folders - Create Logic variables - Get Logic variables - Create Moods - Update Moods - Get Moods - Create Dashboards - Update Dashboards - Get Dashboards - Create Alarms - Get Alarms - Set LED ring settings - Get LED ring settings - Set Google Sync settings (excluded devices) - Get Google Sync settings (excluded devices) - Set audio volume - Get audio volume - Get location - Set location - Install apps - Get apps - Get devices - Create PairSessions - Set device settings - Create HomeyScripts - Get HomeyScripts - Get app settings values - Set app settings values - Get Experiments settings - Set Experiments settings - Get Timeline settings - Set Timeline settings - Get Auto Update settings - Set Auto Update settings - Create Zones - Update Zones - Get Zones Those are a lot of permissions, way more than the regular Web API offers. This means there is no other way to do it other than by reverse engineering the web app’s API. In my opinion, a developer should have the option to allow all scopes. When authorizing with Homey, there should be a big red warning banner stating that the app has full control over their entire Homey and to make sure they trust the app before continuing. Athom should also check API clients before they get published (like with Homey apps) to check that they only have the scopes that they need. But to just block most scopes for third party developer is a bit too much security IMO. The scopes currently offered is not even close to what I would need to create a Transfer Tool for transferring data between Homeys ![image](https://us1.discourse-cdn.com/flex025/uploads/athom/original/3X/5/e/5e3e552a4716f44edae23dfd6d1b68da48e2b9c9.png) ---
**Author:** ![Tim\_Broddin](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/tim_broddin/32/148490_2.png) [@Tim\_Broddin](https://community.homey.app/u/Tim_Broddin)\ **Post date:** [March 17, 2026, 10:20pm UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/9 "2026-03-17T22:20:28Z")
I think it’s only fair that Homey, as creators and guardians of this platform, have way more access than we do 😅 They live and breathe this product, and probably think of edge-cases we don’t even imagine. As for the MCP server, most/all agents ask you for permission for every MCP command, so you’re still behind the wheel. I don’t see anything wrong with that perse (especially if it’s coming from Athmon). But to get this conversation back on the track: it would be nice if we developers could ask for additional scopes. They don’t need to be in the form, but just some formalized way of requesting them would be of tremendous help 🙏 ---
**Author:** ![RonnyW](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/ronnyw/32/10879_2.png) [@RonnyW](https://community.homey.app/u/RonnyW)\ **Post date:** [March 19, 2026, 6:36am UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/10 "2026-03-19T06:36:28Z")
> [@smarthomesven](#): > > But I don’t think you can generate a local API key from the cloud API (the official one), for that you’d need to reverse engineer the web app API It will work. The local API key is just a Bearer token. So you don’t need the oAuth process with client\_id, token handling and reading Homey data first (to get the cloud URL for your Homey) Only thing you need to know is the cloud URL. Some newer models are using rehion specific URLs. But then you also can access the Homey via WWW and cloud API (REST service). ---
**Author:** ![smarthomesven](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/smarthomesven/32/79712_2.png) [@smarthomesven](https://community.homey.app/u/smarthomesven)\ **Post date:** [March 19, 2026, 6:38am UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/11 "2026-03-19T06:38:21Z")
Under which scope is that then? ![image](https://us1.discourse-cdn.com/flex025/uploads/athom/original/3X/8/8/88d4c689a28a424cabc64008adda5df2e543c8db.png) Most of them are readonly and I see nothing about local API keys here ---
**Author:** ![RonnyW](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/ronnyw/32/10879_2.png) [@RonnyW](https://community.homey.app/u/RonnyW)\ **Post date:** [March 19, 2026, 7:11am UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/13 "2026-03-19T07:11:46Z")
The local API key is just used as Bearer token. When creating the key in HP23/HP26, you can set scopes. ---
**Author:** ![smarthomesven](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/smarthomesven/32/79712_2.png) [@smarthomesven](https://community.homey.app/u/smarthomesven)\ **Post date:** [March 19, 2026, 7:14am UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/14 "2026-03-19T07:14:36Z")
Oh okay, but are those all scopes? Like, can you do all operations listed [here](https://athombv.github.io/node-homey-api/HomeyAPIV3Local.html)? I don’t own a HP23/26 myself so I can’t check myself. ---
**Author:** ![Tim\_Broddin](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/tim_broddin/32/148490_2.png) [@Tim\_Broddin](https://community.homey.app/u/Tim_Broddin)\ **Post date:** [March 19, 2026, 7:26am UTC](https://community.homey.app/t/we-could-use-more-scopes/152593/15 "2026-03-19T07:26:44Z")
Yes, all these: ![CleanShot 2026-03-19 at 08.26.28@2x](https://us1.discourse-cdn.com/flex025/uploads/athom/original/3X/a/6/a62c4e0ff7ad14cad92edf29224289ce0953cc73.jpeg)