Documentation

Get your organization up and running in under 15 minutes:

1. Sign up — Create an account with your email and a password
2. Create your organization — Pick a name and URL slug (e.g. north-street-gym)
3. Add a location — Name it (e.g. "Main Entrance"), set a lock code that matches your physical keypad
4. Print the QR code — Open the location and go to the QR & signage tab, download PNG/SVG, print and stick on the door
5. Test it — Scan the QR code with your phone, enter your number and the code we text you

That's it. Visitors can now scan and get access.

This is what a visitor experiences when they arrive at your door:

No app download required. No account needed. Works on any phone with a browser and SMS.

Remembered phones. After one SMS check, that phone is remembered at your organization for 90 days: the next scan shows "Welcome back" and one Open button — no text, no cost. Every rule (hours, members, blocklist, approvals) still runs on every entry.

Depending on how you set up the door, a visitor may see one more step after verifying: give their name once, sign your waiver once, show photo ID once, or wait for you to approve them. Each is explained below.

Visitor names

The first time a phone gets in at your organization, right after the text code, the visitor is asked their name — once. From then on your access log, your approval requests ("Ahmed (••1234) is at Front") and the admin app show it next to the last 4 digits, and the visitor sees "Welcome, Ahmed".

• Choose under Settings → Visitor page → Ask visitors their name: Don't ask, Ask (they can skip), or Required. New organizations ask, with a Skip button.
• Members aren't asked — their name from your members list is used. A name signed on your waiver counts too.
• A visitor is never asked again and can't change it. You can: open the entry in the access log → Add a name or Change; every visit of theirs shows the new name.
• Names are yours only — never shown to other organizations. Search the log by name; the CSV export has a name column.

At locations set to "Trust code required", first-time visitors are also asked for a referral code (e.g. TRUST-7X2K4M) before the OTP is sent — see Walk-in Trust & Referrals.

If the visitor's code doesn't work, they can tap "Code didn't work?" to report the issue. You'll get an email and see it in your dashboard.

Your dashboard has these sections:

• Overview — Today's entries and denials by hour, people waiting for your approval, keypad codes to update, visitor reports, and one tip for your setup
• Locations (called Entrances, Doors… for your kind of place) — each door's rules, keypad code, lock, printable QR sign, staff clock and activity
• Members — your list (one by one or CSV), trust codes and blocked numbers
• Access links — personal links for named people, members' guest passes, and one-day event lists
• Waivers — the waiver people sign once before entry, and who signed it
• Access log (Visits, Check-ins…) — every entry and denial with the visitor's name when known, filters, a live view and CSV export
• Issues — "code didn't work" and "door stuck" reports, grouped by door, with one-tap fixes
• Staff — who's on the clock, weekly hours, flagged punches and payroll CSV
• Integrations — API keys and outbound webhooks
• Billing — your plan, this month's texts, and upgrades
• Settings — organization, visitor page (branding, visitor names, "Text it to me", guest passes), security, help

A location represents a physical door or access point. Each location has:

• Name — e.g. "Main Entrance", "Side Door"
• Slug — URL-safe name used in the QR link: /access/your-org/main-entrance
• Lock Code — The code visitors receive. Must match your physical keypad.
• Access Mode — Open (anyone), Members Only, or Hybrid
• Walk-in Trust — how first-time visitors are treated (see Walk-in Trust & Referrals)
• Lock Tier — Keypad Code or Custom Webhook (see Smart Locks below)
• Doors behind this one — for a gate in front of a building (see below)

A gate and the doors behind it

When an outside gate and a building door are both locked, open the gate's Rules tab → Doors behind this one, tick the building door(s) (up to 5) and choose how long being let in at the gate counts there: 15 minutes, 30 minutes, 1 hour or 2 hours.

• Let in at the gate → the visitor also sees each building door's code and instructions ("Then Prayer hall: 2222"). A smart lock that makes a code per visitor makes one for them. The building door is never unlocked from the gate — they aren't there yet.
• Scanning the building door within that time lets them in with one tap: no second approval, members check, trust check or photo ID — they passed those at the gate. Handy when a smart lock's code has expired.
• The building door's own hours and your blocklist still apply. If it's closed (its hours or "Close now"), the gate says so and shows no code.
• Someone who didn't come through the gate faces the building door's own rules. Leave everything unticked if some visitors only need the gate.
• The access log shows those entries at the building door "via" the gate.

QR Codes

Each location gets a unique QR code. Open the location and go to the QR & signage tab to:

• Download as PNG or SVG
• Copy the access URL
• Print and stick on or near the door

The QR encodes: https://qrgate.app/access/your-org-slug/location-slug

Members are people your organization recognizes. They matter when a location is set to Members Only or Hybrid mode.

Adding Members

• Individual — Click "+ Add member" to open the side panel, then enter phone (required), name and email (optional)
• CSV Import — Upload a CSV with columns: phone, name, email. The phone column is required.

Access Modes

• Open — Anyone can access. Members are tracked but not required.
• Members Only — Only phones in the members list can get a code. Others are denied.
• Hybrid — Anyone can access, but member status is logged for reporting.

Beyond the member list, each location can gate walk-ins (visitors who aren't members) with a trust requirement. (For a scenario-by-scenario overview of every option, see Access Options.) Set it in the location's Rules tab, under Walk-in trust:

• Everyone (Free) — Scans the QR, types their number and the 6-digit code we text them, and gets the door code (or the door opens). Next time their phone is remembered (90 days unless you change it in Settings → Visitor page). Nothing to set up. Every entry is still phone-verified and logged with the last 4 digits.
• Returning visitors (Growth) — Gets in if their phone was let in within the last 12 months — at one of your doors, or at a door that checks people at another place of the same kind on QR Gate (places of worship with places of worship, gyms with gyms). A first-timer is refused. Pick it on the door. Anyone let in at one of your doors, open ones included, counts here. Elsewhere, only entries that meant something count: a member's, or one through a door that checks people, at a place on a paid plan. Trust never crosses kinds of place, and goes quiet after 12 months away.
• Trust code required (Growth) — A returning visitor gets in as usual. A first-timer types the code they were given (like TRUST-7X2K4M) with their number, verifies, and gets in — after that they're a returning visitor. Issue codes on the Members page and share them. Every use is logged against the code and emailed to you; turn a code off any time.
• Ask me each time (Growth) — Verifies their phone, then waits on the page while you decide. Their screen updates the moment you answer; a request expires after 5 minutes. You get a push on the QR Gate admin app, an email and a card on the dashboard — tap approve or decline. Only phone-verified visitors ever reach you.
• Photo ID, once (Pro) — After verifying their phone, a newcomer photographs a driver's license, passport or ID card — and, if you choose, takes a live selfie that must match. Someone already checked anywhere on QR Gate isn't asked again. Choose ID only, or ID plus selfie. Checked by Stripe Identity; we keep only the result, never the photos. $2 per new person checked (passed or not), on your next invoice.

Free includes the basic checks — phone verification, members only, opening hours and the blocklist. A door set up on a rule before a downgrade keeps it.

Members always get in (on by default) lets active members skip the walk-in gate entirely. Turn it off to send members through the same trust check as everyone else.

How trust is earned

A phone let in at any of your doors — open ones included — is a returning visitor at your organization for 12 months. It counts at other places only when the entry meant something: a member's entry, or one through a door that checks people (returning visitors, trust code, ask me each time, photo ID), at a place on a paid plan. That trust is scoped to your community context (places of worship and community spaces, fitness, ranges and clubs, storage, homes and rentals, co-working). Trust earned at community spaces never grants access at gyms, and vice versa — by design, with no override. Trust goes dormant after 12 months of inactivity in a context and can't be revived just by showing up (protects against recycled phone numbers).

Trust Codes

Issue codes from the Trust codes card on the Members page. Share a code (e.g. TRUST-7X2K4M) to vouch for someone:

• The visitor enters it on the access page at a "Trust code required" location
• After they verify by OTP, they're a returning visitor at your organization — and, on a paid plan, at other places in your community context
• Every use is recorded against your organization and you get an email each time your code is used
• Disable a code anytime — existing trust it granted stays, but it can't admit anyone new
• If someone you vouched for is later blocked by 3+ organizations, you'll get a private email suggesting you review the code. Nothing is automatic — the decision stays yours.

Blocked Numbers

Block a number from the Blocked numbers card on the Members page. Blocked numbers are denied at every location, at every trust level, even if they're members. The visitor sees the same "This number can't get in here right now" as any refused number — their block status is never disclosed. Only the last 4 digits are stored for display; the full number is never kept.

Denials show in the Events log as Denied (Blocked) and Denied (First Visit) so you can see exactly why someone didn't get in.

A door can ask newcomers for photo ID once (Pro). Door → Rules → Walk-in trust → Photo ID, once, then choose ID + live selfie (the selfie must match the ID photo) or ID only.

After verifying their phone, a newcomer taps Check my ID, photographs a driver's license, passport or ID card with Stripe Identity (about a minute), and comes back to the code. Someone already checked anywhere on QR Gate isn't asked again — at your door or anyone else's. Members who always get in, and people on an event list, skip it.

Cost: $2 per new person checked — passed or not, since Stripe charges for the check — added to your next invoice. Walking away before the check isn't charged. One phone can try 3 times a day. Needs a card on file.

Privacy: the photos go to Stripe, not to us, and we ask Stripe to delete them as soon as the check is decided. We keep only whether it passed.

Give members temporary access with automatic start and end dates. No manual cleanup needed.

Use Cases

• Visiting members — "Ahmed is visiting for Ramadan (March 1-30)"
• Trial passes — "Sarah has a 30-day gym pass"
• Seasonal access — "Summer volunteers have access June-August"
• Short-term rentals — "Guest checks in Friday, out Sunday"

How It Works

When adding or editing a member, set optional date fields:

• Access From — when their access starts. Before this date, they see "Your access begins on [date]"
• Access Until — when their access expires. After this date, they see "Your access expired on [date]"
• Note — admin label for context (e.g. "Ramadan visitor", "30-day pass")

Leave both dates blank for permanent access (default behavior). The system automatically enforces the window — no manual deactivation needed.

Member Status Badges

• Active — permanent or within their access window
• Temporary — has an access window set
• Upcoming — access hasn't started yet
• Expired — access window has passed

Restrict access to specific hours and days. When enabled, visitors outside the window see "Access is not available at this time."

Setting Up

1. Open the location's Rules tab and turn on "Limit to opening hours"
2. Pick Set times, Prayer times or Sunrise to sunset
3. Set times: click "+ Add a window", set open/close times and the days; add several if needed (e.g. morning + evening)
4. Prayer times: pick the calculation method and Asr, open around each prayer or from Fajr to after Isha, and how many minutes before and after
5. Prayer times and sunrise to sunset need the door's location — type it or use "Use where I am now" at the door

Prayer and daylight hours are worked out every day for that location in your organization's timezone, so they follow the seasons by themselves. The Rules tab shows today's resulting hours. Fixed windows can be added next to a schedule (e.g. Sunday school), and a schedule can apply to some days only (e.g. Fridays for Jumu'ah).

Services, seasons & one-off openings (Growth)

Under the hours on the Rules tab: Services are recurring ("Sunday service 09:00–10:15"), each opening some minutes before and closing some minutes after. Seasons are dates with their own hours, either instead of the usual hours (winter hours, or none at all to stay closed) or as well as them (Taraweeh nights in Ramadan, a pool open only in season), once or every year. One-off openings open the door on one date (a wedding, a fundraiser). Closures still win over all of them. When hours are first switched on, your business type may offer a template (place of worship, range, pool) that fills these in; nothing is saved until you save, and every value can be changed.

Members' own hours (Growth)

A door's hours are for walk-ins. Under Members & access-link holders you can give the people on your members list (and their access links) more: any time, or extra hours on top of the door's, with a switch for whether they also get in on closed days. A walk-in who scans while only members can get in is told so, and when the door opens to everyone. Guests on a member's pass and event lists follow the door's hours; "Close now" applies to everyone.

Close now / open now (every plan)

On a door's page, Close now… shuts it for 30 minutes, an hour, the rest of the day, until a time you pick, or until you reopen it, with a note visitors see ("Closed for a water leak"). Nobody gets in while it's closed: not walk-ins, members, access links or event lists. Staff can still clock out. Open now… opens a closed door for walk-ins for a while; every other rule still applies. The Locations page has Close all now… and Reopen all.

Closures & holidays (Growth)

Under Closures, add closed days or special hours for a date or a range, for every door or some. Pick the US holidays you close for and they're added in one click. Nothing closes unless you pick it, and each one can be edited. A closure applies even to doors whose hours are off. An event list set to open outside hours still opens on a closed day.

Keep your timings in a spreadsheet or another app? Export a CSV and import it under Locations → Closures → Import from CSV (Growth). Download the template for each kind, fill it in, upload: every line is checked, you see what it will change per door, then you import. Uploading the same dates again replaces what that file added — never what you set yourself.

Dates can be 2026-11-01 or 11/1/2026; times 06:30, 6:30 AM or 18:30. Headers can be in any order and case; other columns are ignored. Up to 1,000 rows per file.

date,fajr,dhuhr,asr,maghrib,isha,jumuah_1,jumuah_2
2026-11-01,06:15,13:30,16:15,18:05,19:30,,
2026-11-06,06:20,13:30,16:10,18:01,19:25,13:15,14:15

date,start,end,title,doors
2026-11-14,18:00,22:00,Wedding,Main Entrance
2026-11-20,19:00,21:00,Fundraiser dinner,all

from,to,type,open,close,note
2026-11-26,2026-11-27,closed,,,Closed for Thanksgiving
2026-12-24,2026-12-24,special,09:00,13:00,Short day for Christmas Eve

A prayer timetable goes to doors that follow prayer times; after the last date in the file, its times keep applying until you upload more. Events become one-off openings, closures become closures — both show in the week view.

Calendar feeds (Pro)

Under Import timings → Calendar feeds, paste a calendar's iCal address — Google Calendar ("Secret address in iCal format"), Planning Center, Outlook ("Publish a calendar"), Masjidal's iqama.ics, or any app that offers iCal / webcal. Check it to see the events it would bring in, pick the doors and the minutes before and after, and connect. It's read every 15 minutes; repeating events, moved and cancelled ones follow the calendar; all-day events are left out. A keyword limits it to matching titles.

Planning Center & PushPress (Pro)

Churches: choose Planning Center under Calendars & apps, create a Personal Access Token at api.planningcenteronline.com/personal_access_tokens, paste its Application ID and Secret, and pick which times in your plans open the door — services, rehearsals, or other times. Gyms: choose PushPress and paste your API key; every class opens the door. Both use the same minutes before and after, keyword, per-event switch and failure choice as calendar feeds, and are read every 30 minutes.

Masjidal & Smart Masjid (Pro)

Keep your iqamah times in Masjidal or Smart Masjid? Under Calendars & apps, choose it and enter your Masjidal masjid ID (Masjidal → Settings → Web Integration) or your Smart Masjid API key. Check the timetable, pick the doors that follow prayer times, and connect. Its iqamah times (and Jumu'ah, when the app has them) open those doors with each door's own minutes before and after; on a date the app doesn't cover, or one you switch off, the door's own prayer settings apply. Masjidal is read every 6 hours, Smart Masjid twice a day.

Calendar events add to a door's own hours. For a door that should open only for calendar events, switch on Only open for calendar events on its Rules tab. Switch one event off without touching the calendar; it stays off. If the calendar can't be read, the doors keep the events it last read (or follow their own hours, if you choose) — nothing closes because a calendar broke — and you get an email after 3 failed reads in a row. The address is stored encrypted.

The lock code is what visitors receive after verification. It must match the code on your physical keypad.

Setting a Code

In the location's Door code tab you can type any code directly or generate a new one.

Code Generation Rules

Configure how random codes are generated:

• Length — 1 to 20 characters
• Character set — Digits only, letters only, or both
• Prefix/Suffix — Code always starts or ends with specific characters

Rotation Policy

• Manual — You rotate when you want
• Daily — Auto-rotates at midnight
• Weekly — Auto-rotates every Monday
• Monthly — Auto-rotates on the 1st
• Custom — Set your own interval

Important: When the code rotates (manually or automatically), you must also update your physical keypad to match. You'll get a reminder on your dashboard until you confirm.

Ways to open a door today:

Keypad Code (default)

After verifying their phone, the visitor sees the code on screen and types it into your physical keypad. Works with any keypad lock.

Wi-Fi smart lock (Pro, no per-door fee)

Yale, August, Schlage, Kwikset, igloohome, Lockly and Nuki, connected through Seam.

1. Door → Lock tab → Connect a smart lock, and sign in to your lock brand's account. If the sign-in page keeps coming back after you sign in, try another browser (Safari or Chrome)
2. Pick the lock for this door. Other locks in that account aren't touched or billed. Your door's keypad code goes on the lock too, so the backup code always works

• Every visitor gets their own code, set on the lock for 30 minutes and then gone — nothing to share
• Visitors you approve at an "ask me each time" door get their own code too — these locks don't unlock remotely through QR Gate (the lock service allows only 5 remote actions a day)
• When the lock reports it opened, the access log says the door was released, not just that a code was shown
• Low battery, the lock going offline or a code that didn't take — you get an email, and the door's Activity tab shows when the lock went offline and came back
• When you change the door code, the new one goes on the lock and the old one comes off. A code you added yourself in the lock's app stays until you remove it there
• Fail-safe: if the lock or Seam can't be reached, the visitor gets your keypad code

SmartThings hub lock (Pro, no per-door fee)

Z-Wave, Zigbee and Matter locks paired to a Samsung SmartThings hub — Schlage, Yale, Kwikset and more.

1. Door → Lock tab → SmartThings hub lock → Connect SmartThings, sign in to Samsung and choose your location
2. Pick the lock for this door

• The door unlocks itself for each verified visitor — no daily limit
• Or switch the door to own code per visitor: QR Gate keeps three code slots on the lock for visitors and never touches your own codes. Codes are removed about 30 minutes later
• The lock's own report confirms each entry; low battery and the lock going offline are emailed to you

Home Assistant lock (Pro, no per-door fee) — coming soon

In testing: we're trying it on real locks before it opens to every Pro organization. The steps below are how it will work.

Any lock your Home Assistant controls — Z-Wave, Zigbee, Matter. Our QR Gate integration connects out to us: no port forwarding, no Home Assistant Cloud needed, and QR Gate only sees the locks you choose.

1. Install the integration: download qrgate-integration.zip, unzip it in your Home Assistant config folder (it creates custom_components/qrgate) and restart Home Assistant
2. Door → Lock tab → Home Assistant lock → Get a pairing code
3. In Home Assistant: Settings → Devices & services → Add integration → QR Gate, type the code, and choose the lock(s) QR Gate may open
4. Back on the Lock tab, pick the lock for this door

• The door unlocks itself for each verified visitor, usually within a second
• Home Assistant tells QR Gate when the unlock was ours, so the access log shows the entry as confirmed
• To change which locks QR Gate may open: Settings → Devices & services → QR Gate → Configure

Prefer no add-on? The Custom Webhook below works with our ready-made Home Assistant blueprint.

Unlocked hours (SmartThings, Pro; Home Assistant coming soon)

For a crowd — Jumu'ah, a service, Taraweeh — the door can stay unlocked during windows you choose instead of everyone scanning one by one.

• Door → Lock tab → Unlocked hours: tick the prayers, services or other windows from the door's own hours, with how many minutes before and after. Nothing is ticked until you tick it
• It only unlocks while the door is open by its hours — a closure or Close now locks it straight away; Open now never unlocks it
• Keep the lock's auto-lock on. When the lock bolts itself during a window, QR Gate unlocks it again; if QR Gate, the hub or the internet goes down, the door locks itself. When a person locks it, it stays locked until the window ends
• At the end QR Gate locks it and waits for the lock to confirm; if it can't, you get an email (and a push in the admin app) and it keeps trying. Home Assistant also locks it by itself at the end (integration 0.2.0 — download the zip again if you installed it before)
• Lock now on the Lock tab locks it at once and keeps it locked until that window ends

Custom Webhook

Send a POST request to your own endpoint when access is granted.

1. In the location's Lock tab, select "Custom Webhook"
2. Enter your endpoint URL
3. Click "Test" to verify connectivity

The URL must start with https:// (one saved earlier over plain http keeps working, with a warning on the Lock tab). The payload is HMAC-signed with that door's signing secret (Lock tab → Signing secret). Verify it before opening anything — otherwise anyone who learns the URL could open the door. Fail-safe: If the webhook fails, the visitor receives the keypad code.

Every unlock request carries two signatures, both HMAC-SHA256 with the door's secret, as lowercase hex:

• X-QRGate-Signature: sha256=<hmac> — of the raw request body (the original scheme; still sent)
• X-QRGate-Timestamp: <unix seconds> and X-QRGate-Signature-V2: t=<timestamp>,v1=<hmac> — of the timestamp, a dot, then the raw body (1760000000.{"event":…}). Prefer this one: check the signature, then refuse the request if the timestamp is more than 5 minutes from your clock, so a captured request can't be replayed later
• X-QRGate-Delivery — a unique id per request, if you want to ignore one you've already handled

Coming soon

Our own fail-secure door kit (a relay for an electric strike) is next. See Door hardware for what each option costs and does.

Three ways to let in people you know ahead of time (Growth and Pro). Each person confirms their own phone once — a link alone opens nothing — and every entry is logged against them.

Access links

A personal link for a named member — a contractor, a tenant, a coach. Access links → Issue link: pick the member, the doors and an end date or number of uses. It's texted (or emailed) to them; they confirm their phone once and then tap Open or Show code. Revoke it and it stops on the next tap.

Guest passes from members

Switch on in Settings → Visitor page → Guest passes, and set how many passes a member can have at once and the longest pass (4 hours, today, or 3 days). Right after the door opens for a member — or from their access link — they tap Bring a guest, enter the guest's name and number, and the guest gets their own link. Passes never outlast the member's own access and stop if the member is paused or removed. You see every pass as "Guest · invited by …" in Access links and can revoke any of them. Each pass counts one text.

Event lists

For one day — Eid prayers, an open day, a match. Access links → + Event list: name, date (all day or from–to), which doors, then paste names and numbers or upload a CSV. During the event, anyone on the list gets in by scanning the normal QR code — even at a members-only door, and outside opening hours if you allow it. The list stops by itself afterwards; you see who was let in. You can text everyone the date (counts toward your texts).

Everyone signs your waiver or house rules once before they get the code (Growth and Pro).

1. Waivers in the sidebar → write the title and text → Publish
2. Switch on Require before entry

After verifying their phone, a visitor who hasn't signed sees the text, types their full name and ticks "I've read this and agree" — then gets the code. Later visits skip it. Publishing a new version asks everyone to sign again. You see each signature (name, last 4 digits, version, date, door) and can export them as CSV.

Coming soon as its own product. The staff clock is becoming a product of its own, QR Gate Clock, and isn't available on accounts yet. This is how it will work — join the waitlist to hear when it's ready.

Staff clock in and out with their own phones at the same QR code — no time clock to buy.

1. Door → Staff clock tab → switch it on, and tap Use my current location while standing in the store
2. Print the punch link as a QR and put it at the register or back door

The first time, a staff member enters their number, the SMS code and their name. After that their phone is their badge: scan, tap IN or OUT. Punches are never refused — odd ones are flagged for you instead: far from the store, location off, a new phone, two punches seconds apart. Staff shows who's on the clock and weekly hours, exports CSV for payroll, and you get a summary email every Sunday.

Kiosk screen (strict mode)

Have a computer or tablet at the counter? It can show a punch QR that changes every 15 seconds and works once — so nobody can clock in from a photo of the printed QR at home.

1. On the store computer, open qrgate.app/kiosk — it shows a 6-character code
2. Door → Staff clock tab → Kiosk screen → type the code. The screen switches to a big clock and the QR

Once a door has a screen, punches that didn't scan it still count but are flagged ("didn't scan the screen", or "kiosk screen off" if it was down), as are reused or old codes. Double-click the screen for full screen; it keeps itself awake and reconnects on its own.

Customize how the visitor access page looks for your organization. Available on GROWTH plan and above.

Customizable Fields

• Display Name — shown on the visitor page instead of your org name (e.g. "North Street Gym")
• Logo — square image URL, displayed above the title
• Primary Color — hex color code for buttons and accents (e.g. #16a34a for green)
• Welcome Text — custom message below the title (e.g. "Please verify your phone to receive the door code.")

Setup

1. Go to Dashboard → Settings → Visitor page
2. Fill in any fields you want to customize (all are optional)
3. Click "Save"
4. Visit your access page to see the changes

All branding is optional. Without it, visitors see the standard QR Gate look.

API keys let your external software interact with your QR Gate data. Requires GROWTH plan or above.

Creating a Key

1. Go to Dashboard → Integrations and find the API keys section
2. Click "Create Key", enter a label
3. Copy the key immediately — it's shown only once

Using the Key

Include it in the X-API-Key header:

curl -H "X-API-Key: qrg_your_key_here" \
  https://api.qrgate.app/api/v1/orgs/:orgId/members

Revoking

Click "Revoke" next to any key. It stops working immediately. This cannot be undone.

Receive real-time HTTP notifications when events happen in your organization.

Setting Up

1. Go to Integrations and click "+ Add webhook" in the Webhooks section
2. Enter your endpoint URL
3. Select which events to subscribe to
4. Copy the signing secret — shown only once

Available Events

• access.granted — A visitor was granted access
• access.denied — A visitor was denied access (with the reason in result)
• code.rotated — A lock code was changed (the new code is never sent)

Every payload includes a plain-English text line, so a Slack incoming-webhook URL works as-is.

Payload Format

POST https://your-endpoint.com/webhook
Header: X-QRGate-Signature: sha256=<hmac>
Header: X-QRGate-Delivery: <delivery id — the same on every retry>
Content-Type: application/json

{
  "event": "access.denied",
  "orgId": "clx...",
  "locationId": "clx...",
  "locationName": "Main Entrance",
  "phonePartial": "**7823",
  "result": "DENIED_NOT_MEMBER",
  "timestamp": "2026-03-24T14:32:00Z",
  "text": "Access denied at Main Entrance · **7823 · not on the members list"
}

Retries

Reply with any 2xx within 10 seconds. Anything else (including redirects, which aren't followed) is retried after 1 min, 5 min, 30 min, 2 h, 6 h and 12 h — about a day in all. Use X-QRGate-Delivery to ignore a delivery you've already processed. Integrations shows the latest delivery result for each webhook.

Verifying Signatures

Verify the X-QRGate-Signature header against the raw request body (not re-serialized JSON) using your signing secret:

const crypto = require('crypto');

// rawBody: the exact bytes received, e.g. express.raw({ type: 'application/json' })
const expected = 'sha256=' + crypto
  .createHmac('sha256', YOUR_WEBHOOK_SECRET)
  .update(rawBody)
  .digest('hex');
const received = req.headers['x-qrgate-signature'] ?? '';

const valid = received.length === expected.length &&
  crypto.timingSafeEqual(Buffer.from(received), Buffer.from(expected));
if (!valid) return res.status(401).send('Invalid signature');

All API routes are prefixed with /api/v1/. Authenticate with X-API-Key header.

Members

GET    /api/v1/orgs/:orgId/members          # List all members
POST   /api/v1/orgs/:orgId/members          # Add a member { phone, name?, email? }
POST   /api/v1/orgs/:orgId/members/bulk     # CSV import { members: [...] }
PATCH  /api/v1/members/:id/toggle           # Toggle active/inactive
DELETE /api/v1/orgs/:orgId/members/:id       # Remove member

Trust Codes & Blocklist

GET    /api/v1/orgs/:orgId/trust-codes            # List codes with usage counts
POST   /api/v1/orgs/:orgId/trust-codes            # Issue a code { label? }
PATCH  /api/v1/orgs/:orgId/trust-codes/:id/toggle # Enable/disable

GET    /api/v1/orgs/:orgId/blocklist              # List blocked numbers (last 4 only)
POST   /api/v1/orgs/:orgId/blocklist              # Block { phone }
DELETE /api/v1/orgs/:orgId/blocklist/:id          # Unblock

Locations

GET    /api/v1/orgs/:orgId/locations         # List locations
POST   /api/v1/orgs/:orgId/locations         # Create { name, slug, lockCode?, ... }
GET    /api/v1/locations/:id                  # Get location details
PATCH  /api/v1/locations/:id                  # Update location
DELETE /api/v1/locations/:id                  # Delete location
POST   /api/v1/locations/:id/rotate-code     # Rotate lock code { code?, rules? }

Access Events

GET    /api/v1/orgs/:orgId/events
  ?locationId=   # Filter by location
  &result=       # GRANTED, DENIED_OTP, DENIED_HOURS, etc.
  &from=         # ISO date start
  &to=           # ISO date end
  &page=         # Page number
  &limit=        # Items per page (max 100)
# Each event has visitorName (the name they gave, or their member name; null if unknown)
# and phonePartial (last 4 digits) — never the full number

Webhooks

GET    /api/v1/orgs/:orgId/webhooks          # List webhooks
POST   /api/v1/orgs/:orgId/webhooks          # Create { url, events[] }
PATCH  /api/v1/webhooks/:id/toggle           # Pause/resume
DELETE /api/v1/orgs/:orgId/webhooks/:id       # Delete

A new visitor is a phone we text a 6-digit code to. Once verified, that phone is remembered for 90 days and opens with one tap — no text, no limit. On Free, once this month's 50 are used, phones we haven't seen can't get a code until the 1st (returning visitors still get in). Paid plans are never cut off: we email you at 80% and 100%.

Upgrade anytime from Dashboard → Billing. Downgrades take effect at the end of your billing period, and nothing you've set up stops working — you just can't add more of a feature your new plan doesn't include (API keys and webhooks pause). The Free plan is how to try QR Gate — there's no separate trial. Need more than Pro? Ask about Enterprise.

• Phone numbers are never stored raw in access logs — only SHA-256 hashes and last 4 digits for display
• Lock codes encrypted at rest — AES-256-GCM encryption, decrypted only when shown to visitors
• API keys are hashed before storage — SHA-256, raw key shown once on creation
• Webhook secrets are shown once — on creation only; we keep them to sign deliveries
• All outbound webhooks are HMAC-signed — verify the X-QRGate-Signature header
• Session tokens are single-use — 10-minute expiry JWTs, invalidated after first verification
• CAPTCHA protection — Cloudflare Turnstile on the visitor phone form prevents bot abuse
• Rate limiting — 3 texted codes per phone per hour, plus limits on sign-in attempts, checkouts and visitor reports
• Stripe webhook verification — signature check prevents forged billing events
• Checkout rate limiting — 3 attempts per org per hour prevents card testing
• Organization scoping — every dashboard and API request is checked against your organization before any data is read or changed
• Security headers — CSP, HSTS, X-Frame-Options, helmet on API
• Admin passwords are bcrypt-hashed — sessions are short-lived signed cookies, never stored server-side
• Fail-safe design — if smart lock or webhook fails, visitors get the keypad code instead

Get help directly from the dashboard. Go to Settings → Help & Support to find:

• Report a Bug — select a category (visitor flow, dashboard, lock codes, members, QR codes), describe the issue, and optionally add reproduction steps. We receive an email immediately.
• Request a Feature — tell us what problem it would solve and how you'd like it to work. Feature requests help us prioritize development.
• Contact Support — for questions, account issues, or anything else. Include your email and we'll respond as soon as possible.

All submissions are tracked in our internal system. We review every ticket.

Visitor Feedback

When a visitor reports an issue (e.g. "Code didn't work"), you'll:

• Receive an email notification immediately
• See it on the Issues page, with a count next to it in the sidebar
• Find the reports in the location's Door code tab too
• Resolve individual reports with one click