Print a code, stick it where the real world happens — the front door, the guest wifi card, the workshop bench — and every scan reaches your Home Assistant instance seconds later as a webhook trigger. Flip a scene, announce an arrival, log who scanned what and when.
Nothing to install from HACS, no integration to configure: an automation with a webhook trigger gives you a /api/webhook/ URL, and we POST the full scan event to it. The event's fields are right there in the trigger data for your conditions and actions.
In Home Assistant: Settings → Automations & scenes → new automation → Webhook trigger. Set a long, random webhook ID, allow POST, and turn off 'Only accessible from the local network'. Your URL is https://your-instance/api/webhook/[id].
Console → Notifications → Add channel → Home Assistant. Drop the URL into the Webhook URL field, save, then hit Send test — the automation fires and the event shows up in its traces.
Attach the channel to specific links and QR codes — the front-door code triggers the arrival scene, the workshop code triggers something else entirely.
Dynamic QR means the sticker on the door never changes even when its destination does. Point it at the guest-wifi page today and the house manual next month — the scan keeps triggering your automation throughout.
The Home Assistant channel sits on the console's Notifications page like any other — named per automation, testable with one click while you watch the trace, pausable when you're mid-rebuild.
Not a bare ping: the full scan event — code, source, destination, tags, timestamp, device — arrives at your Webhook URL within seconds of the scan.
Every delivery carries Svix-compatible signature headers
(webhook-id, webhook-timestamp,
webhook-signature) signed with your channel's
whsec_ secret, and failures retry on a backoff
ladder for up to six attempts — with every attempt visible in
the console's delivery log. Verification docs →
{
"event": "click",
"source": "qr",
"code": "spring-launch",
"shortUrl": "go.yourbrand.com/spring-launch",
"title": "Spring launch pack",
"destination": "https://yourbrand.com/spring",
"tags": { "campaign": "spring-24", "sku": "SB-114" },
"createdAt": "2026-05-02T09:14:11Z",
"ts": 1752319441000,
"at": "2026-07-12T10:44:01+00:00",
"ip": "203.0.113.7",
"ua": "Mozilla/5.0 (iPhone; …)",
"referer": null,
"customerId": "cus_9f2k…"
}The full event rides in the POST body — in your automation it's trigger.json, so conditions and templates can branch on code, source, tags or time of day.
Home Assistant URLs aren't forced to HTTPS at validation — though the endpoint still has to be reachable from the internet for the POST to arrive.
Deliveries carry Svix-compatible signature headers keyed to your channel's whsec_ secret — belt and braces on top of the unguessable webhook ID.
Instance mid-update when someone scans? We retry at 30s, 2m, 10m, 15m and 15m — six attempts across roughly 43 minutes.
The scan hits our redirect plane, the guest lands on the destination, and your automation fires — typically all inside a couple of seconds.
Every delivery attempt is recorded in the console with its response code, so you can tell a missed automation from a missed delivery.
No. Home Assistant's built-in webhook trigger is the whole receiving end — create an automation with a webhook ID and paste its /api/webhook/ URL into the console. Nothing to install, nothing to keep updated.
Only if the webhook URL is reachable from the internet — deliveries come from our cloud. Home Assistant Cloud (Nabu Casa) remote access works, as does your own reverse proxy or tunnel. A URL that only resolves on your LAN can't receive the POST, and remember to untick 'Only accessible from the local network' on the trigger.
Anything Home Assistant can do. The event arrives as trigger.json — which code, click or QR scan, destination, tags, timestamp, device — so one automation can run a scene for the door code, announce on a speaker for the guest code, and log everything to a helper or notify service.
Treat the webhook URL as a secret — the long random ID is the primary defence, and deliveries also carry signed Svix-style headers you can inspect. That said, Home Assistant's webhook trigger doesn't verify signatures natively, so keep genuinely sensitive actions behind additional conditions in the automation itself.
The redirect still works instantly for the person scanning — delivery to your instance is a separate, retried step. We attempt six deliveries over roughly 43 minutes and log each with its response code; if the instance stays down longer than that, the event shows in analytics but the automation won't have fired.
Smart URLs, dynamic QR codes and a full API — branded on your own domain, safety-screened, and tracked. Build, re-point and measure it all in one place.
Start free trialBranded short links on a domain you control — editable, screened, and tracked.
Branded QR codes you can re-point any time — never reprint the poster again.
$ curl -X POST api.xengo.io/v1/links { "domain": "go.acme.com", "url": "https://acme.com/…" } → 201 go.acme.com/aB3xK▋
Create and manage links + QR at scale, straight from your own tools.
14-day free trial, card required, cancel anytime. One webhook URL, one printed code, and the house reacts.