qr

qr.farfield.systems

QR records encode arbitrary payloads. In direct mode the QR carries the exact target string. In proxy mode the QR carries https://qr.farfield.systems/r/{id}; that stable URL redirects to the current target, so the destination can be edited without reprinting the QR code.

Public image and redirect endpoints only work for records marked both public and enabled.

Screenshot of the Farfield qr UI — QR code admin table in the logged-in state. The scan and redirect endpoints are public; the code list is token-gated.

Authentication

The scannable image (/qr/{id}) and redirect (/r/{id}) stay public — strangers scan them, and a public/enabled record is required either way. The enumerating /api/codes list and detail require a bearer token — send the read key as Authorization: Bearer <token> or X-API-Key; the write key is also accepted. /status stays public.

API

GET /qr/{id}

SVG QR image for a public/enabled record; strong ETag

GET /r/{id}

303 redirect for public/enabled proxy records

GET /api/codes

{ "codes": [QRCode, …] } — public/enabled only; strong ETag

GET /api/codes/{id}

QRCode — 404 if missing, private, or disabled; strong ETag

GET /status

{ "service": "qr", "ok": true, "codes": N }

Write endpoints (POST /api/codes, PUT /api/codes/{id}, DELETE /api/codes/{id}) require an API key and the QR_API_KEY environment variable must be set on the service.

The HTML admin UI is rooted at / and is gated by the shared password.

Record Shape

QRCode

{
  "id": "string",
  "label": "string?",
  "mode": "direct | proxy",
  "target": "https://…",
  "ec": "L | M | Q | H",
  "public": true,
  "enabled": true,
  "cid": "bafk…",
  "createdAt": "2024-01-01T00:00:00Z",
  "updatedAt": "2024-01-01T00:00:00Z"
}