Build on the same verification engine we use

Core building blocks

• API Applications & Credentials — register an application under your organization and issue scoped API keys/secrets for server-to-server calls.
• Mobile Applications & Devices — register a mobile app, then register individual devices to receive short-lived device session tokens.
• Public Verification — a single unauthenticated endpoint for Simple QR codes, exactly what powers qrauthix.com/v/{code}.
• Mobile Verification — device-session-authenticated endpoints for Simple and Secure QR, the latter requiring a signed challenge/nonce.
• Webhooks — subscribe an HTTPS endpoint to verification events; deliveries retry with exponential backoff on failure.

A typical mobile integration flow

1. Register your mobile application once, at build time, to get an ApplicationId.
2. On first launch, register the device (platform, app version, attestation data) to receive a short-lived device session token.
3. For a Simple QR scan, call the mobile "verify simple" endpoint with the device session.
4. For a Secure QR scan, first request a one-time challenge, sign/return its nonce, then call "verify secure" — replays and mismatched nonces are rejected outright.

Rate limits & environments

Public, mobile, developer, and admin traffic are rate-limited on independent tiers so a spike in consumer scans never starves your own dashboard or integration traffic. Exact limits are tuned per deployment and returned via standard rate-limit response headers.