Developer surface
API access for agencies, automations, and serious operators
Every dashboard workflow is backed by a JSON API on https://api.qrscan.ink/api. Production sessions start through passwordless sign-in plus rCAPTCHA protection.
Authentication and scopes
Production browser sessions begin with passwordless sign-in plus rCAPTCHA protection. Automation uses API or MCP bearer tokens. Tokens can be limited by scope, business id, expiration, revocation, and per-minute rate.
Rate limits
Named throttles protect auth, public forms, rCAPTCHA, QR redirects, user API calls, token calls, MCP, AI, admin writes, exports, and webhook tests. A 429 response means retry after the standard Laravel rate-limit reset window.
Pagination
Growing list responses return Laravel paginator objects under their resource key, such as {"qr_links":{"data":[],"current_page":1,"per_page":25,"total":0}}. Use ?per_page=1..100.
Error shape
Validation, auth, authorization, and throttling responses use constant JSON envelopes with message and, for validation, errors. Treat 401, 403, 422, and 429 as non-retryable except rate limits.
Public rCAPTCHA flow
Public lead forms must call POST /api/public/rcaptcha/challenge, verify with POST /api/public/rcaptcha/verify, and submit the returned one-use token to POST /api/public/lead-submissions.
Webhook safety
Webhook targets must be HTTPS public hosts. Deliveries include X-QRScanInk-Timestamp and X-QRScanInk-Signature, an HMAC over timestamp.payload. Reject timestamps outside a five-minute replay window.
Bulk import and export caps
CSV import preview validates headers, reserved slugs, duplicate slugs, and HTTPS destinations before save. Exports return clear caps through GET /api/exports/bundles.
Client-owned integrations
GET /api/integration-guides returns help URLs and client fields for self-serve setup. /api/integration-credentials stores business-scoped credentials, masks values after write, and never returns full secrets.
Integration delivery logs
POST /api/integrations/{key}/sample-event sends or records test scan, lead, conversion, service request, order intent, report, recall, product passport, and widget lead payloads. Delivery logs are redacted and retryable.
Launch-depth endpoints
WalletCard exports use GET /api/wallet-passes/{id}/export?format=vcf|ics|html|apple|google. GS1 workflows use POST /api/gs1/validate, GET /api/product-passports/{id}/exports, POST /api/product-passports/{id}/recall-override, and GET /api/product-passports/{id}/analytics. Restaurant request-only operations use public rCAPTCHA-protected service/order endpoints plus GET /api/restaurant/order-intents/{id}/ticket, POST /api/restaurant/order-intents/{id}/advance, and GET /api/restaurant/pos-handoff. Team handoff uses POST /api/team-invites/accept; agency proof uses POST /api/reports/bundles.