Quick answer
A custom HTTPS widget source requests data from a web endpoint you choose. It can add flexibility, but you must understand what the endpoint receives and what happens when the service stops responding.
Know who receives the request
A custom HTTPS data source connects to a service you choose. It may send the chosen URL, query parameters and configured authentication to that service. If background refresh is enabled, those requests can occur when you're not actively editing the widget. HTTPS encrypts traffic in transit but does not prevent the destination service from processing request details.
WidgetCraft stores saved credentials locally with Android Keystore encryption. This does not make the remote service invisible: the network provider can receive ordinary request metadata, including an IP address. Do not place API tokens in a public URL or in a screenshot you plan to share.
Try it on your home screen
- Start with a simple public test endpoint that requires no personal information or secret key.
- Confirm the response format matches what the widget's data parser actually supports.
- Test a successful response, an empty value and a temporary network failure.
- Only then consider a private service, and avoid exposing tokens in shared designs or screenshots.
Start with a low-risk test
Choose a service that allows automated requests and has documented usage terms. Test a read-only endpoint with non-sensitive content. Confirm the result format and error behavior before attaching it to a prominent widget. A test that works in a browser may still fail in an app because headers, certificates, authorization or rate limits differ.
Prepare for failures
If the provider is down or your network is offline, the widget should not pretend the last response is newly fetched. Prefer a “last updated” label when supported. Lower update frequency if a service limits requests, and stop refresh when the information is no longer useful.
Advanced connections are optional. If all you need is date, battery or a local habit count, a custom endpoint adds complexity without much benefit. See privacy and local data for what stays on the phone.
Check the result
HTTPS protects traffic in transit, but it does not make an unknown service trustworthy or guarantee that a key stored in an application is secret. Frequent polling may use battery and network data. Set realistic expectations for refresh intervals and provide fallback text if the app supports it.
Common question: Can I paste any JSON API URL and expect it to work?
No. The app must support the specific data format, authentication method and field mapping. Some APIs also restrict client-side access or request frequency.