Built to make counterfeiting expensive and verification effortless
Qrauthix combines two verification tiers, a risk-scoring engine, batch-level traceability, and a full developer platform — all on top of the same organization/product/QR data model.
Two verification tiers, one platform
Not every product needs the same level of protection. Qrauthix issues QR codes as either Simple or Secure, and every code carries that decision permanently:
Open, browser-based verification
Anyone can scan a Simple QR code with their phone's default camera. It resolves to a public page (qrauthix.com/v/{code}) that calls our verification API directly — no app install, no login. Ideal for everyday consumer goods where friction-free verification matters most.
App-gated, challenge/response verification
Secure QR codes deliberately refuse to resolve in a browser. The public landing page never confirms or denies whether the code is valid — it just points to the Qrauthix mobile app, which requests a one-time, 60-second challenge over its registered device session and only then gets a verdict. A captured request can't be replayed, and a copied code that keeps getting scanned is flagged by the risk engine.
Risk Assessment Engine
Every verification — successful or not — is scored in real time. The engine considers signals like unusual geography for a given product, verification velocity (the same code checked many times in a short window), and repeated attempts against a single-use code, then buckets the result into configurable Low / Medium / High risk bands. High-risk activity surfaces immediately in the admin console so your fraud team can investigate before a pattern becomes a recall.
Batch & Expiry Management
Products are organized into manufacturing batches with a batch number, manufacturing date, expiry date, and quantity. QR codes inherit their batch's lifecycle automatically — a code tied to an expired batch stops verifying the moment the expiry date passes, no manual deactivation needed. Single-use codes additionally lock out after their first successful verification.
Mobile SDK Surface
The mobile application flow registers a device, requests a short-lived device session, and then calls either the simple or secure verification endpoint depending on the code type. Secure verification adds a single-use challenge on top. Device attestation (Google Play Integrity) is on our roadmap and not yet enforced.
Developer Platform
Every organization can provision API applications and scoped credentials, register mobile applications, and subscribe webhook endpoints to verification events — with automatic retry and exponential backoff on delivery failures. See For Developers and the API overview for details.
Audit Logging & Retention
Logins, verifications, and administrative actions are all written to an immutable audit trail with independently configurable retention windows for verification traces, audit logs, and API request logs — so you can answer compliance questions without keeping data forever.