Developer REST API v1 & Webhooks Suite

The Developer Platform for Dynamic QR Codes at Scale

Create saved QR records, automate managed redirects, and receive scan events through asynchronous HMAC-signed webhooks using scoped Bearer API keys.

Create a beta API key API Console Sandbox

curl -X POST https://www.jeffdash.com/api/v1/qr-codes \
  -H "Authorization: Bearer qrm_live_99e3123f34560647..." \
  -H "Content-Type: application/json" \
  -d '{
    "title": "Summer Campaign Promo",
    "type": "url",
    "deliveryMode": "managed",
    "destination": "https://brand.example/summer-sale",
    "customization": {
      "fgColor": "#0f172a",
      "dotStyle": "dots"
    }
  }'

{
  "data": {
    "_id": "jd7abc123def456",
    "slug": "Summer99",
    "title": "Summer Campaign Promo",
    "type": "url",
    "deliveryMode": "managed",
    "destination": "https://brand.example/summer-sale",
    "isActive": true,
    "customization": {
      "fgColor": "#0f172a",
      "dotStyle": "dots"
    },
    "totalScans": 0,
    "password": false
  },
  "meta": {
    "message": "QR-code succesvol aangemaakt via API v1.",
    "isDynamic": true,
    "deliveryMode": "managed",
    "capabilities": {
      "isTrackable": true,
      "canEditWithoutReprint": true,
      "requiresInternet": true,
      "supportsManagedAccess": true,
      "supportsUrlRouting": true
    },
    "qrPayload": "https://www.jeffdash.com/r/Summer99",
    "publicRedirectUrl": "https://www.jeffdash.com/r/Summer99"
  }
}

Browser-rendered preview

Summer Campaign Promo

The REST API returns record data and the authoritative QR payload. Export image files from the dashboard.

API quickstart

From key to verified integration in 3 steps

1. Generate API Key

Grab your secret `qrm_live_...` key from the developer console in 1 click.

2. Create QRs via REST POST

Send title, type, destination, an optional deliveryMode, and supported customization fields; bulk requests accept up to 500 records.

3. Listen for Webhooks

Receive asynchronously scheduled events with HMAC-SHA256 headers and best-effort device and coarse location fields.

Webhook fan-out planner

Estimate your webhook delivery volume

This upper-bound scenario assumes every selected event is sent to every configured endpoint. It is a capacity estimate, not an uptime or latency promise.

Monthly subscribed events:100,000 / mo

10K250K500K1M+

Configured Webhook Endpoints:5 endpoints

15 (default)1020+

Maximum candidate deliveries / month:500,000

Configured endpoints:5

Per-delivery safeguards:6 s timeout · 64 KiB payload

Core API v1 Endpoints

GET/api/v1/qr-codes

Retrieve the 100 most recent saved QR records in the authenticated workspace.

POST/api/v1/qr-codes

Create a native or managed QR record with supported customization and capability-dependent routing fields.

PATCH/api/v1/qr-codes/:id

Update supported record fields. Managed payloads change without reprinting; native payloads require a new export. Eligible native records can be upgraded once.

POST/api/v1/qr-codes/bulk

Create up to 500 saved QR records in one request and receive an indexed success or error result per item.

Implemented integration controls

Managed resolver delivery

Managed delivery uses a server route so tracking and later content updates are possible. Actual latency depends on deployment and network conditions.

HMAC-SHA256 Webhook Security

Each delivery carries a timestamp and HMAC over the timestamp plus raw body so receivers can verify integrity and origin.

Dashboard image export

The API returns record data and a QR payload. SVG, PNG, and WEBP exports are available from the dashboard; there is no SVG asset endpoint yet.

Custom CNAME Domains

Verify ownership before binding a hostname. Provider-side provisioning and certificates require the configured Vercel integration.

Privacy-conscious scan telemetry

Store timestamp, coarse country/region/city, browser, OS, device category, referrer, and UTM fields when available—never precise GPS.

Per-key rate limits

Keys default to 100 requests per minute and can be configured up to the active plan cap. There is no public beta uptime SLA.

Developer FAQ

How do I authenticate API requests?

All requests to /api/v1/* require a Bearer token in the Authorization header: `Authorization: Bearer qrm_live_...`. You can generate and rotate keys from the Developer Dashboard.

How are webhooks secured?

Each webhook request includes an `X-QRCodeMaster-Signature` header containing an HMAC-SHA256 signature computed using your webhook signing secret. This allows you to verify that the event originated from QRCodeMaster.

What are the rate limits for the API?

A key defaults to 100 requests per minute. During the billing-disabled beta, administrators can configure up to 10,000 per minute; the paid-plan policy will be documented before enforcement is enabled.

Can I generate vector SVG QR codes directly?

Not through REST yet. The API returns record data and the authoritative QR payload. Open the saved record in the dashboard to export SVG, PNG, or WEBP.

Start building with the QRCodeMaster API

API access and webhooks are enabled while billing enforcement is off during beta. Validate the integration in your own environment before production use.

Create Free Developer Account