DoorPass

A Ring doorbell press, a booking and a tap on the member's pass open a real smart lock, so practice rooms, self-storage and gyms can run their front door with nobody at the desk.

Comment

Inspiration

Music practice rooms, self-storage and 24-hour gyms all hit the same wall at night: someone is at the front door and nobody is at the desk. The usual fixes are a shared door code that leaks, a keypad nobody updates when a membership lapses, or a manager getting woken up to buzz people in. Many of these places already have a Ring doorbell at that door. We wanted that doorbell to run the door.

What it does

DoorPass opens the door only when three facts line up:

Fact Comes from
Presence: someone is at this door now A Ring doorbell press (button_press webhook)
Permission: they're booked for now The booking system (10 minutes early is fine)
Identity: it's the member A tap on their pass within 60 s of the press, in either order

All three: a real smart lock opens and locks again after 10 s. Anything missing (no booking, an expired membership, a stranger) becomes a one-tap request to the manager that expires closed after 90 s. The manager can answer on the dashboard or just ask Alexa: "Alexa, who's at the studio door?" → "Let them in."

  • Door log with evidence: every decision records the Ring event, the booking, the lock's own report and the time it took.
  • Tailgating: Ring person-motion events right after an opening are counted; a second person is flagged.
  • Ring snapshot + Amazon Nova: after a press, DoorPass fetches Ring's photo and Nova writes one sentence for the manager (people, packages, uniforms; never identity).
  • Staffed hours: the doorbell only announces visitors.
  • Fail-secure: lock offline, nobody answering, a replayed or forged webhook, a restart while open: the door stays (or goes back to) locked, and the member is told what to do.

How we built it

  • Ring Partner API (real device): a Ring Battery Doorbell 2K linked through a private app with one-way account linking (token exchange, nonce matching after the manager signs in, app-integrations, refresh tokens). Webhooks are verified with HMAC-SHA256 over the raw body before parsing, deduped on request_id, and refused when older than 10 minutes. REST calls read devices, status and capabilities, and every minute DoorPass checks /v1/history/devices/{id}/events against the webhooks it got, so a missed webhook is caught.
  • The hands: Ring's API is read-only, so the lock is a SwitchBot Lock Vision over SwitchBot OpenAPI v1.1 (unlock, lock, status read-back). On the real door the lock accepts the unlock about 0.4 s after the press reaches DoorPass.
  • Alexa+ via MCP: DoorPass runs its own MCP server (Streamable HTTP, protocol 2025-11-25) with who_is_at_door, let_them_in, keep_door_closed, door_log and todays_bookings, plus an MCP App door card whose Let in / Keep closed buttons call tools back through the host. Alexa+ add-on tooling isn't open to hackathon entrants, so the dashboard hosts a simulated Alexa+ client that talks to the real MCP server.
  • Amazon Bedrock: free speech goes to the Converse API (Amazon Nova Pro), which picks DoorPass's MCP tools; DoorPass's own MCP server runs them. Without the manager's key, the door-opening tools are never offered to the model. Nova also describes each Ring snapshot.
  • Node 22 + TypeScript, no framework, 28 tests on the gate's rules, account linking, webhook signatures, snapshots and the Bedrock agent.

Challenges we ran into

The Ring Developer Playground can't send doorbell webhooks, its device has no event history, and its token lasts 30 minutes, so we linked a real doorbell and built a webhook signer/simulator to test against. Real webhook event ids also didn't match the documented format. Every one of these is written up in FRICTION_LOG.md (task, steps, expected vs actual, severity, workaround, suggestion), 11 entries in total.

Accomplishments that we're proud of

  • A real Ring press reaches DoorPass 1.4 s after Ring's own event timestamp, and the real lock accepts 0.4 s later.
  • Every failure case was rehearsed against the live door (REHEARSAL.md), and none of them opens it.
  • Judges can try everything without hardware in the sandbox, with a simulated doorbell and lock.

What we learned

Ring works best as the eyes of a system, not the whole system. Combined with a booking and a phone, a doorbell press turns into an access decision that a small business can trust and audit.

What's next for DoorPass

Booking-system connectors (Mindbody, Square Appointments, storage management software), more lock brands, and packaging it for the Ring Appstore so any space with a Ring doorbell can turn it on.

Open source

The Ring webhook signing, verification, simulator and receiver are published separately as ring-webhook-kit (MIT, zero dependencies): https://github.com/mikey92/ring-webhook-kit

Try it

Built With

Share this project:

Updates

Submission history