Use a webhook trigger

Create the trigger and link

A webhook lets an external service send one request to a task or subroutine you choose. You must be signed in so the link can reach your account's space.

1. In Library, open the task or subroutine and choose Add trigger, then Hook.
2. Choose Queue to make it due, Interrupt to start it when a member device next processes the fire, or Log done to record a completed task. Log done is available only for tasks.
3. Attach the trigger. Open Library → Rules, select the external automation, and choose Create link, then Copy link in its setup controls. The full link is shown only when you create or rotate it; save it securely.

Save values for Log done

In the Hook editor, choose Log done to save a subject and capture values for the task. For example, make separate Water hooks for a morning glass and an evening glass. Their labels include the saved details so you can distinguish them in the app and Shortcuts.

Send an empty body to use these presets. Request values override matching saved fields, and a request subject overrides the saved subject. Hooks do not fall back to the task’s ordinary quick-log defaults. Queue and Interrupt do not use capture presets.

If a field or subject becomes unavailable, review the warnings in the Hook editor. Invalid saved values are omitted from the log, and the delivery history reports preset changes to review. An invalid value supplied by the request is rejected instead.

Send a request

Send an HTTP POST to the copied URL. An empty JSON body works for Queue and Interrupt; Log done can include the task's capture values. The URL also supports GET: an HTTP GET has no side effect. In a browser it shows a confirmation page; choose Run trigger to send the POST.

1. In your automation tool, set the request method to POST and the Content-Type to application/json. A device may instead send an empty body with no Content-Type.
2. Use {} as the body when no subject or capture is needed. Add subject_id or at only when you know the selected space's subject ID or need a permitted timestamp. Capture is accepted only for Log done.
3. Send the request. In the external automation’s setup controls, choose Refresh and Show deliveries to inspect your personal link’s accepted requests. Delivery rows describe accepted execution outcomes. The Request attempts section separately shows accepted requests, deduplicated retries, rejections, rate limits and server errors when they can be tied to your installation. It shows the latest 50 recorded attempts; up to 200 are retained per installation. Unknown or old rotated links cannot be attributed, and a history-storage outage can leave gaps. Request bodies, headers and raw links are not stored in attempt history.

Connect a shared button or HTTP service

In the external automation’s Installations section, enter a Shared device name and choose Install shared device. Put its one-time link into your button or hub’s HTTP request configuration. Choose POST with an empty body and no Content-Type, or application/json with {} if JSON is required. Test one press and inspect Deliveries for that device.

The installing member owns the credential. Logs are attributed to that member, not the person pressing a shared button. Rotating or revoking one device leaves other installations active.

A successful HTTP response confirms receipt; it does not prove queued work started or finished. Guards and already-queued work can affect the result. Check Today or the target task’s history too.

Require an additional secret header

In an active personal or shared-device installation, choose Set secret header and confirm. Copy the one-time value into your HTTP client’s X-Subroutine-Secret header. Missing or incorrect values are rejected before delivery or retry lookup. Only the installation’s owner can manage it; other members’ links are unchanged.

The server stores only a hash and cannot show the value again. Refresh displays whether a secret is required but clears the one-time display. Rotate secret header if the value was lost or needs replacing, then update your clients. Rotating the private URL preserves the header requirement. Remove secret header to allow the private URL alone to fire again.

A protected link still opens a confirmation page, but you must enter the secret there before choosing Run trigger. The page cannot retrieve it automatically. A URL tag alone therefore cannot fire a protected installation without the additional secret.

Install a trigger in the iOS app

Use Update saved label and mode after editing a trigger’s details. Use Update saved secret after rotating its secret; the private URL stays on the device. After rotating the link itself, install its new URL. Remove from this device removes the saved picker entry without revoking the server link. Signing out clears the device’s installed credentials.

Opening or refreshing setup checks for revoked or rotated links and removes obsolete saved entries. Saved status alone does not prove a link or secret is valid. If an action reports an uncertain result, check history before running it again: each intentional invocation is a new action, and there is no automatic offline queue or retry.

1. Open the external automation’s personal-link setup in the current iOS app. Create a link, or rotate it if its one-time URL is no longer available. Rotating invalidates existing copies, so update any other clients using it.
2. In Shortcuts on this iPhone, enter the secret header if you enabled one, then choose Install in Shortcuts. This saves the credential securely on this device without firing it.
3. In Shortcuts, add Fire Subroutine trigger and select your saved trigger. Run it when you intend to perform the action, then inspect delivery and task history. The action requires an internet connection and can run without opening Subroutine.

Use a phone shortcut or NFC tag

In iOS Shortcuts, you can make a shortcut with a Get Contents of URL action: paste your hook link, choose POST, and use an empty JSON body when no extra details are needed. Run it once to check the delivery history. You can then create a personal NFC automation in Shortcuts that runs that shortcut when your phone scans a tag. This is the manual fallback for clients without the native action. In the current iOS app, you can instead select Fire Subroutine trigger in your personal automation after installing the trigger. The NFC or location automation must still be configured on your phone.

For a tag that opens a web page, write the hook link itself as an NDEF URL. In the current native app on an NFC-capable iPhone, choose Write NFC tag beside a newly created or rotated personal/device URL. Confirm replacing its contents and keep the tag still until the app reports a verified write. This does not fire the trigger, lock the tag or write a secret header. If a write is uncertain, inspect the tag before relying on it. Other clients can use a compatible tag-writing tool. A browser asks for confirmation. If the link opens in the native app, Log done can run immediately when Log without confirming is enabled in Settings → Preferences. Queue, Interrupt and links requiring an installation secret still ask first. Completions are credited to the installation owner. Open test page always asks for confirmation, even with that setting enabled. The tag contains the full credential URL, so treat it as private and rotate the link if the tag is lost.

Install a shared device

In Library → Rules, select the external automation and enter a label for the shared device, then choose Install shared device. Copy device link is available when the credential is issued; keep it for that device’s setup.

The installation list shows member display names and device labels. You can rotate, revoke and inspect deliveries for installations you own. Removing a member revokes their installations. Show revoked installations reveals retained history.

If the result of a change is uncertain, use Refresh installations before retrying. If you no longer have the issued URL, rotate that installation to receive a replacement.

Manage the link

Turn the trigger off in the task or subroutine editor to stop new fires without deleting its history. Rotate link when you need a new URL; old copies of that installation’s link stop working, so update the automations or tags using it. Other members’ installations are unaffected. Revoke link to disable it without creating a replacement.

Queue and Interrupt create due work; they do not record it as completed. An Interrupt starts only when an open member device processes the synced fire. Log done records a completed task immediately and attributes it to the account that created the link.