QR verification

What the QR code carries, who can read it, and what happens offline.

Two different squares get called “the QR code”, and they do different jobs.

• The barcode on the pass. Defined by the template's barcode block — qr, code128, pdf417 or aztec — and carrying whatever source names, usually the serial. This is what a scanner at a door reads, and it works with the phone offline because the pass is on the device.
• The QR on a certificate or a public page. Carries the credential's verification URL. Anyone who scans it lands on the public page, with no app and no account.

Reading one in your own system

Send whatever the scanner produced to POST /v1/verify as code. It accepts the serial, the public code and the full verification URL, so your scanner does not have to know which of the three it just read.

const res = await fetch("https://api.nomi-tech.com/v1/verify", {
  method: "POST",
  headers: {
    "Authorization": `Bearer ${process.env.NOMI_API_KEY}`,
    "Content-Type": "application/json",
  },
  body: JSON.stringify({ code: scanned, location: "North gate" }),
});

const { valid, reason, subject } = await res.json();
if (!valid) reject(reason);        // "revoked", "expired", "suspended"…
else admit(subject.displayName);