Hey team Homey! I love the Homey API! But I would love it even more if some of the scopes currently reserved for the official Homey apps could be made available to us. Some notable omissions in the scopes available for third party devs include moods, and creating/updating (advanced) flows. Do you …

Yes, I’ve posted this before as well. They said that it’s not permitted for security reasons. For now I’m trying to reverse engineer the API from the web app to get access to all features of my Homey Pro 2019. [image] Web API client scopes Developers In the De…

I get the security implications for things like installing apps (you could easily create a small botnet if tokens leak), but accessing moods and even creating flows seem relatively safe to me. The havoc you can wreak with a leaked key seems to be about the same as with the homey.device.control scope…

[image] Tim_Broddin: you could easily create a small botnet if tokens leak Did you know Athom doesn’t review the code of community apps? There’s a hidden route (that’s not visible to regular users) in the Homey Developer Tools, which is the page they use for reviewing apps. I couldn’t see any…

Looking deeper into it, a possible flow could be: ask for OAuth permissions first to resolve the (local/remote) url, and use a locally generated API key for the advanced scopes. This would only work on 2023+, but it’s not too bad as a workaround.

[image] Tim_Broddin: and use a locally generated API key for the advanced scopes That won’t work in my case since I have a Pro2019, but if you have a Pro2023 or later then it might work. But I don’t think you can generate a local API key from the cloud API (the official one), for that you’d n…

[image] Peter_Kawa: but I don’t understand why AI tools are allowed to set, change and create such things: More importantly: why are the AI tools allowed to do that, but other apps aren’t? For an app I’m currently building, I would need at least these permissions: Create Flows Update Flows G…

I think it’s only fair that Homey, as creators and guardians of this platform, have way more access than we do :sweat_smile: They live and breathe this product, and probably think of edge-cases we don’t even imagine. As for the MCP server, most/all agents ask you for permission for every MCP comman…

[image] smarthomesven: But I don’t think you can generate a local API key from the cloud API (the official one), for that you’d need to reverse engineer the web app API It will work. The local API key is just a Bearer token. So you don’t need the oAuth process with client_id, token handling …

Under which scope is that then? [image] Most of them are readonly and I see nothing about local API keys here

We could use more scopes

Developers

Peter_Kawa March 17, 2026, 5:46pm 7

Call me blonde, but I don’t understand why AI tools are allowed to set, change and create such things:

Topic		Replies	Views
Web API client scopes Developers	5	176	December 15, 2025
Homey App, Permissions HomeyApi => Flow.triggerFlow Developers app , flow , homey-pro	11	621	September 11, 2025
Feature request: expose per-app storage usage to OAuth2 Web API Clients Ideas & Suggestions featurerequest	2	56	July 30, 2026
Missing scope in web app Developers	0	110	December 2, 2025
Connecting to the Homey API? Questions & Help	26	3789	January 10, 2023

We could use more scopes

Related topics