TAPIN

Tap in. You're in.

NFC tap-to-check-in for events: register once, tap your phone at the desk, and the organizer sees you arrive live.

See it on Devpost

Built and demoed live in 24 hours at CodeRED Orion 2026

TapIn: an attendee taps a phone on an NFC desk sticker and the organizer's dashboard shows the check-in live.

The problem

Check-in is still a queue

QR codes buried in email, scanner glare, and printed lists hold up the line at the door.

Organizers reconcile a spreadsheet afterwards, so they don't know who is actually in the room until it's too late to react.

How it works

One backend, two ways to tap

Diagram: Desk Tag works on any phone with no app by tapping an NFC sticker; Phone Key turns an Android phone into an NFC tag that sends a new signed URL on every tap. Both go to one TapIn server that updates the organizer dashboard live.

  1. Your phone is the key

    Android, Host Card Emulation

    The TapIn Pass app turns an Android phone into an NFC tag. Every tap emits a new signed URL, so a copied or photographed tap can't be replayed.

  2. Any phone is the scanner

    Scan one QR

    Staff scan a QR from the dashboard and become a scanner-only reader for that desk. No accounts, no app, no dashboard access.

  3. The dashboard is live

    Server-Sent Events

    Each arrival lands as a big green card with a checked-in counter, a searchable registrant list, manual check-in and undo, and CSV import and export.

Desk Tag mode (a passive NFC sticker any phone can tap, no app) is built and verified in automated tests; physical sticker rollout is next.

Screenshots

What it looks like

TapIn Pass Android app showing the attendee's pass, ready to tap.
Phone keyThe TapIn Pass app on Android, ready to tap.
Staff reader phone showing a green checked-in result with the attendee's name.
ReaderThe staff phone confirms the check-in.
Attendee's phone showing a persistent Checked in status.
AttendeeYour own phone says you're in.
Organizer dashboard in board view with a large green card showing the latest arrival.
Arrivals boardLatest check-in, readable across the hall.
Organizer dashboard with checked-in counter and searchable registrant table.
DashboardCounter, search, manual check-in and undo.
Desk setup screen with the Add a scanner QR code and desk configuration.
Desk setupAdd a scanner with one QR.

Security

Built so a tap can't be faked

  • Hashed tokensAttendee tokens are random; the server stores only their SHA-256 hash.
  • Encrypted pass secretsAES-256-GCM on the server, Android Keystore-backed storage on the phone.
  • Per-tap HMAC and counterEach tap is signed over the pass id and an incrementing counter; old or reused counters are rejected as replays.
  • Scanner-only sessionsQR-joined scanners can check people in at one desk and nothing else.
  • Rate limitsTaps, registrations and staff sign-in are rate limited per network.
  • Random staff PINIn production, a random 6-digit PIN is generated when none is set, and wrong PINs lock sign-in for a minute.

Tech stack

Under the hood

  • Node 24
  • TypeScript
  • Hono
  • node:sqlite
  • zod
  • Server-Sent Events
  • Vite
  • React
  • Tailwind CSS
  • React Router
  • Web NFC
  • Kotlin
  • Android HCE (Type 4 Tag)
  • Android Keystore
  • Cloudflare Tunnel