# Webhooks needs more security? **URL:** \ **Category:** Questions & Help\ **Created:** [January 15, 2026, 9:00pm UTC](https://community.homey.app/t/webhooks-needs-more-security/149362 "2026-01-15T21:00:12Z")\ **Posts on this page:** 15\ **Page:** 1
**Author:** ![mdragon](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/mdragon/32/121042_2.png) [@mdragon](https://community.homey.app/u/mdragon)\ **Post date:** [January 15, 2026, 9:00pm UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/1 "2026-01-15T21:00:12Z")
I got my Homey Pro 2026 today and have been playing around with it a bit now. Basically it’s a really nice system, but I’m very surprised there’s no way to block webhooks originating through the cloud-connection? Not even a way to add a bearer token or similar. Anyone, anywhere in the world could “access” my Homey Pro through [https://webhook.homey.app/[homey-id]/](https://webhook.homey.app/%5Bhomey-id%5D/) and get an “OK” back. This shouldn’t be possible without some kind of token/authentication. Worse even is that only homey-id:s that exists replies with an “OK”. If the id does not exist you’ll get an error saying this homey id doesn’t exist. Even if the homey-id is some kind of UUID with lots of bits, IF someone get hold of it, you’ll have to remove everything and create a new id. You really need to implement some kind of bearer token to access homeys through the cloud, and fix so you can’t check if a homey-id exists or not by the reply from webhook.homey.app. ---
**Author:** ![smarthomesven](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/smarthomesven/32/79712_2.png) [@smarthomesven](https://community.homey.app/u/smarthomesven)\ **Post date:** [January 15, 2026, 9:03pm UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/2 "2026-01-15T21:03:05Z")
Webhooks are meant to be used that way, since many services where you can enter them don’t allow authentication to be set. This is also the reason why you should keep your Homey CloudID private (don’t share it). ---
**Author:** ![mdragon](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/mdragon/32/121042_2.png) [@mdragon](https://community.homey.app/u/mdragon)\ **Post date:** [January 15, 2026, 9:13pm UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/3 "2026-01-15T21:13:34Z")
Well at least in many other systems using webooks you can use white-listing of ip-addresses. So what are people using webhooks for? I was going to trigger a webhook from a local server connected to an ANPR-camera to open my garage door, based on some other logic too (not only licens plate), but I would feel a lot better if that webhook only could be triggered locally. ---
**Author:** ![smarthomesven](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/smarthomesven/32/79712_2.png) [@smarthomesven](https://community.homey.app/u/smarthomesven)\ **Post date:** [January 15, 2026, 9:17pm UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/4 "2026-01-15T21:17:46Z")
> [@mdragon](#): > > So what are people using webhooks for? I use it with MacroDroid using the webhook.homey.app/cloudid/battery?tag=[batterylevel] every time my phone battery level changes so I can turn a light red when my phone needs charging. I also use it with my tablet to send a notification to my phone when the tablet is low on battery. ---
**Author:** ![Peter\_Kawa](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/peter_kawa/32/173848_2.png) [@Peter\_Kawa](https://community.homey.app/u/Peter_Kawa)\ **Post date:** [January 15, 2026, 10:30pm UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/5 "2026-01-15T22:30:43Z")
> [@mdragon](#): > > I would feel a lot better if that webhook only could be triggered locally. You could have searched for _local webhook_ 😉 > [@Webhook via local network](https://community.homey.app/t/webhook-via-local-network/17252/33): > > [http://192.168.12.34/webhook?event=my\_event&tag=my\_secret\_key](http://192.168.12.34/webhook?event=my_event&tag=my_secret_key) where `192.168.12.34` represents your Homey’s IP address ---
**Author:** ![mdragon](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/mdragon/32/121042_2.png) [@mdragon](https://community.homey.app/u/mdragon)\ **Post date:** [January 15, 2026, 10:47pm UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/6 "2026-01-15T22:47:21Z")
There should be a tag and a token. What if I want the tag to be some input data? Also the token would be stored inside the flow. All tokens should have a special section in the app so it’s easy to get an overview and change the tokens easily when needed. ---
**Author:** ![smarthomesven](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/smarthomesven/32/79712_2.png) [@smarthomesven](https://community.homey.app/u/smarthomesven)\ **Post date:** [January 15, 2026, 10:48pm UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/7 "2026-01-15T22:48:38Z")
It might be possible to build an app for something like that, using API endpoints with query parameters. You can learn more about building apps here: > **[Welcome to the Apps SDK documentation 👋 | Homey Apps SDK](https://apps.developer.homey.app/)** > > Learn how to build great apps that run on Homey. Or you can request an app here: > [@\[Requests\] Homey Pro Community App Requests](https://community.homey.app/t/requests-homey-pro-community-app-requests/2713): > > Homey Pro Community App Requests Welcome to the Homey Pro Community app request topic. This topic is to centralize all app requests for Homey Pro Apps, made by the community. (This does not account for app(s) for Homey (bridge), only for the Homey Pro, as Athom only wants apps made by brands or by themselves.) For Requests at Athom please use the Official link in the Appstore, see the description in this Topic: [[Requests] Official Homey App and Device Request](https://community.homey.app/t/requests-official-homey-app-and-device-request/103771) The more information that you… ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [January 16, 2026, 5:01am UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/8 "2026-01-16T05:01:31Z")
That’s just an alternative way of triggering, it doesn’t block the cloud-based entry point. ---
**Author:** ![robertklep](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/robertklep/32/160628_2.png) [@robertklep](https://community.homey.app/u/robertklep)\ **Post date:** [January 16, 2026, 5:09am UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/9 "2026-01-16T05:09:17Z")
> [@mdragon](#): > > Even if the homey-id is some kind of UUID with lots of bits… It’s not, it’s a MongoDB ObjectID. Which means it encodes various information, like a timestamp of when it was created. ObjectID’s were never meant to be secure. ---
**Author:** ![dsdevries](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/dsdevries/32/80220_2.png) [@dsdevries](https://community.homey.app/u/dsdevries)\ **Post date:** [January 16, 2026, 9:02am UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/10 "2026-01-16T09:02:02Z")
I think the best way to secure the Webhooks is to add a SSO service (either locally or in the cloud via Auth0 or Cognito or Google) that can generate an access token for you. You send that access token along as a tag to your Webhooks. In your flow, you can then use the logic card “make [method] request to [url] with [headers] headers and [body] body” card to relay the request to a separate server where you can verify the access token. I don’t think there’s a way to use a Crypto library inside a homey script to verify it locally, is there? You might also be able to obtain a bearer token from Homey, send that one along, and use the Homey API itself to verify that token. But bearer tokens are officially not meant to be used that way. And at this point, it also starts to become clear what the difference is between Webhooks and API’s. Webhooks are essentially a way to implement ultra fast event based triggers to keep systems up to date. Like others have said before, they are meant to be public. You can use them to relay information between systems including access tokens. If you really want a secure way to extract or manipulate data directly, you should actually use the api for that. > **[Getting a bearer token | Homey](https://homey.solweb.no/advanced-api-usage/bearertoken)** > > Getting an Athom Homey bearer token is not straight forward ---
**Author:** ![Andy\_Henderson](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/andy_henderson/32/80642_2.png) [@Andy\_Henderson](https://community.homey.app/u/Andy_Henderson)\ **Post date:** [January 16, 2026, 11:04am UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/11 "2026-01-16T11:04:52Z")
If you want a webhook that can be used only locally, the ‘Micro web server’ app supports that. Web calls work only via the local network using the same subnet. To activate a flow, you need a ‘Web trigger … was received’ card to start the flow. I use the feature a lot and it works well. Andy ---
**Author:** ![mdragon](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/mdragon/32/121042_2.png) [@mdragon](https://community.homey.app/u/mdragon)\ **Post date:** [January 16, 2026, 11:08am UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/12 "2026-01-16T11:08:39Z")
Thanks, that would probably be what I’m looking for. ---
**Author:** ![Peter\_Kawa](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/peter_kawa/32/173848_2.png) [@Peter\_Kawa](https://community.homey.app/u/Peter_Kawa)\ **Post date:** [January 16, 2026, 3:38pm UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/13 "2026-01-16T15:38:53Z")
> [@robertklep](#): > > That’s just an alternative way of triggering, it doesn’t block the cloud-based entry point True, but it doesn’t send the Homey ID to internet, if I understand the functionality correctly. But whole you mentioned it, it should be possible to disable the cloud-based webhooks all in all. ---
**Author:** ![Peter\_Kawa](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/peter_kawa/32/173848_2.png) [@Peter\_Kawa](https://community.homey.app/u/Peter_Kawa)\ **Post date:** [January 16, 2026, 3:42pm UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/14 "2026-01-16T15:42:50Z")
> [@mdragon](#): > > There should be a tag and a token. What if I want the tag to be some input data? The way it currently works, you can add a token, or passphrase to either the event or tag. Preferrably to the event, while the tag part is optional. You can use the tag part for anything; I might have used an unclear phrase as placeholder. ---
**Author:** ![smarthomesven](https://sea1.discourse-cdn.com/flex025/user_avatar/community.homey.app/smarthomesven/32/79712_2.png) [@smarthomesven](https://community.homey.app/u/smarthomesven)\ **Post date:** [January 16, 2026, 3:58pm UTC](https://community.homey.app/t/webhooks-needs-more-security/149362/15 "2026-01-16T15:58:13Z")
You can also keep the Homey ID private. I recommend not sharing it, as pairing view HTML files are also not protected. This means that if you know the IDs of the custom pairing views, you can create a script to enumerate which apps are installed on the Homey. Some apps also don’t protect their API endpoints, which means you might be able to view content from those.