Direct answer
Build dynamic NFC tags with stable HTTPS URLs, Firestore data, secure rules, Firebase Hosting, Android App Links, safe redirects and privacy-aware analytics.
Use a stable public identifier
A dynamic tag stores a durable HTTPS URL containing an opaque tag reference, while the destination and mode live in managed data. Owners can update the resolver record without rewriting an installed NFC tag or reprinting its QR partner.
- Opaque slug
- Use an unguessable or non-sensitive identifier that reveals no customer name, email, internal database path or access token.
- Canonical host
- Keep the resolver on a domain the product controls so platform or vendor changes do not strand physical assets.
Design the Firestore document model
A record can contain owner reference, active mode, validated destination, optional task reference, status, created and updated timestamps and a schema version. Operational counters should be separated from fields an ordinary client can edit.
- Versioned schema
- Readers should handle known versions explicitly and reject unknown structures rather than inferring fields from partial data.
- Lifecycle state
- Support active, paused, retired and deleted behavior so a missing document is not the only way to disable a deployed tag.
Enforce Firestore Security Rules
Mobile and web client requests are evaluated against Security Rules, while server libraries rely on IAM. Rules should bind writes to the authenticated owner, validate the complete allowed field set and protect server-managed analytics.
- No open wildcard
- A broad allow read, write rule turns every physical tag into an editable redirect and creates an immediate phishing risk.
- Field validation
- Constrain mode, destination type, string lengths and immutable ownership rather than checking only whether a user is signed in.
Resolve destinations safely
The public endpoint loads the record, confirms active state, validates the destination against policy and returns either a controlled page or redirect. Never concatenate untrusted values into headers or permit arbitrary schemes.
- Scheme allowlist
- Restrict public URL mode to HTTPS and reject javascript, data, file and malformed destinations.
- Open redirect defense
- Apply owner, domain and abuse checks when saving the destination, not only after a consumer taps the tag.
Cache without making updates unpredictable
Hosting and edge caches improve latency but can serve an old destination after an owner changes the record. Set cache policy according to the product promise and provide an immediate purge or short TTL for urgent safety changes.
- Resolver response
- Cache controlled lookup results only for a documented interval and avoid caching personal or authorization-specific content publicly.
- Update feedback
- Show when a new destination becomes effective so operators know whether field testing should still expect the previous route.
Verify Android App Links
Android App Links associate HTTPS paths with an installed application through manifest intent filters and a Digital Asset Links file at /.well-known/assetlinks.json. Users without the app stay on the web instead of receiving an app-only error.
- Signing fingerprint
- Use the Play App Signing certificate fingerprint for production builds and serve assetlinks.json over HTTPS without a redirect.
- Routing scope
- Declare a clear path scope in the manifest and handle unrecognized or retired identifiers safely inside the app.
Replace deprecated Firebase Dynamic Links
Firebase Dynamic Links shut down on August 25, 2025, so new physical deployments must not depend on page.link or the retired service. Firebase Hosting can still serve the domain, resolver and association files while app routing uses Android App Links directly.
- Inventory
- Find every printed and encoded legacy prefix, export metadata and preserve migration redirects where the old service still allows recovery.
- New architecture
- Own the HTTPS link contract and test installed, uninstalled and older-app journeys without the Dynamic Links SDK.
Support URL mode and task mode separately
URL mode should resolve to public content in a browser. Task mode can open a verified app link and retrieve an authorized task profile, but it must not execute sensitive actions from arbitrary Firestore fields without local review and policy.
- Offline
- Cache only an explicitly trusted task version and show that it may be stale when the network is unavailable.
- Fallback
- If the app is not installed, present an explanation and Google Play link rather than exposing an internal task payload.
Collect minimal resolver analytics
A resolver can count taps by tag, product or campaign without identifying the person. Channel, timestamp and coarse technical outcome may be sufficient; precise location and persistent device fingerprinting require a separate purpose and consent decision.
- Server-managed
- Clients should not write authoritative counters directly because they can be manipulated and conflict under load.
- Retention
- Aggregate old events and delete raw records according to an explicit operational window.
Operate the resolver as long-lived infrastructure
Physical tags can remain deployed for years, so monitor TLS, DNS, hosting, database quota, redirect errors and abuse reports. Export the mapping and document a disaster-recovery path before the first large installation.
- Retirement
- A retired tag should resolve to a controlled status page or safe successor, never an expired domain or reusable unclaimed slug.
- Cost
- Load-test hot campaigns and protect the database from a scan spike with caching, rate controls and bounded queries.
Quick reference
| Layer | Stored responsibility | Primary control |
|---|---|---|
| Physical tag | Stable HTTPS reference | Small public NDEF payload |
| Firestore | Owner and current mode | Rules plus validated schema |
| Resolver | Destination decision | HTTPS, allowlist and rate limit |
| Android app | Verified deep action | App Links and local consent |
Related NFCMagic app screens
These screenshots connect this dynamic NFC tags with Firestore guide to the related Android workflow in NFCMagic. They document interface states; radio behavior still requires a physical Android device and real tags.
Frequently asked questions
Do dynamic NFC tags require rewriting when the destination changes?
No. The tag keeps the stable resolver URL and the authorized owner updates the backend record.
Can Firebase Dynamic Links be used for a new NFC project?
No. The service shut down on August 25, 2025. Use owned HTTPS URLs and platform App Links.
Where must assetlinks.json be hosted?
Serve it at the verified domain's /.well-known/assetlinks.json path over HTTPS without redirects.
Can task mode execute any action from Firestore?
It should not. The app must validate the profile, ownership, version, permissions and local safety policy before execution.
Primary technical sources
- Firebase Dynamic Links deprecation FAQ — Official shutdown and migration guidance for Firebase Dynamic Links.
- Android Developers: About App Links — Verified web-to-app routing and Digital Asset Links behavior.
- Firebase: Cloud Firestore Security Rules — Official access-control and data-validation model for Firestore clients.