TapIn

Tap in. You're in. NFC tap-to-check-in for events: attendees tap their phone at the desk, see an instant green confirmation, and organizers watch check-ins appear live on a web dashboard.

Comment

Inspiration

Every event starts with a line, a clipboard and a spreadsheet. QR check-in just moves the fumbling from paper to phones. Everyone already carries an NFC-capable phone, and NFC stickers cost cents. We wanted check-in to be a single tap, with the organizer seeing it live.

What it does

TapIn is an NFC tap-to-check-in system for events. Attendees register once on the web (first name, last name, email) and keep a pass on their phone. At the desk they tap their phone and get a big green confirmation, on the staff reader and on their own phone ("You're in!", "Already checked in", plus a persistent "Checked in" status). Organizers watch every check-in appear live on a web dashboard that runs on a laptop, tablet or TV: a live check-in card, a checked-in / total counter, a searchable registrant table, manual check-in and undo, desk open/close, CSV import and attendance export, and multiple events.

There are two modes on one backend:

  • Phone Key (our demo path): a native Android app (TapIn Pass) uses Host Card Emulation so the attendee's own phone acts as the NFC tag, emitting a fresh signed URL on every tap. A staff iPhone signed in as staff in Safari reads it: each tap shows an iOS banner the staff taps once, then Safari shows the result and the dashboard flashes live. We verified on real devices that an iPhone background-reads a tag emulated by a Galaxy S25 Ultra. After each tap the attendee's phone shows its own result via a signed status check.
  • Desk Tag (also built): a no-app desk-sticker mode for any phone, verified in automated tests; physical sticker rollout is next. The sticker holds a URL for the desk; the phone's private cookie identifies the attendee.

Why it is different: event check-in is QR almost everywhere. NFC today means expensive wristbands with vendor readers, or Apple/Google Wallet NFC that needs certificates and certified readers. TapIn is a cheap sticker, any phone and any laptop, plus a phone key without certification. It is aimed at hackathons, clubs, meetups and small conferences that cannot afford enterprise check-in.

How we built it

  • Server: Hono on Node 24 with the built-in node:sqlite, zod validation, Server-Sent Events for live updates.
  • Web: Vite, React, TypeScript, Tailwind CSS and React Router, with a Web NFC "write to sticker" helper for Android Chrome.
  • Android: Kotlin app with an NFC Type 4 Tag emulation service and Keystore-backed secret storage.
  • Security: random per-boot staff PIN with brute-force lockout, loopback-only server behind the tunnel, request body limits, per-IP rate limits on taps and registration, tap pages that never re-send on reload, CSV formula-injection guard, SHA-256 hashed web tokens, AES-256-GCM encrypted pass secrets, single-use hashed provisioning codes, and constant-time HMAC-SHA256 tap signatures with a monotonic counter for anti-replay.
  • Public HTTPS through a Cloudflare quick tunnel for the demo. Built solo.

Challenges we ran into

  • A web page cannot make a phone act as an NFC tag; phone-as-key needs a native Android app with Host Card Emulation.
  • iPhones can read NDEF URL tags but cannot emulate one, and show a banner that must be tapped.
  • Google Wallet Smart Tap cannot carry a custom payload and cannot be read by an iPhone, so we ruled it out.
  • The demo tablet has no NFC, so the dashboard is a plain responsive web page that any screen can show.

Accomplishments that we're proud of

  • A phone-key check-in where the attendee sees their own result, plus a no-app desk-sticker mode (built and verified in automated tests, not yet rolled out on physical stickers).
  • A working phone-as-key mode: Android emulates an NFC tag and an iPhone reads it, verified on real devices.
  • Replay-resistant design: Phone Key taps change on every tap, so a copied or photographed tap cannot be reused.
  • A live organizer dashboard with the full registrant workflow, built end to end by one person.

What we learned

NFC behaves very differently across Android and iOS, and security choices (what lives in the URL versus the device) drive the whole design. Keeping side effects on POST, not on opening a link, matters when phones can open tag URLs automatically.

What's next for TapIn

  • Upgrade desk stickers to NTAG 424 DNA with Secure Unique NFC (SUN): an AES-CMAC-authenticated URL with a counter on every tap, so sticker URLs cannot be copied or replayed. Not built yet.
  • Physical desk-sticker rollout and field testing. Phone Key beyond Android: iOS only allows third-party tag emulation in the EEA with an Apple entitlement, so iPhone attendees will use the desk sticker.
  • Reminders and attendance analytics for organizers.

Built With

Share this project:

Updates

Submission history