QRSansar API
Drive QRSansar from your own systems. Create and retarget dynamic QR codes, upload documents, publish product passports and pull scan analytics over a plain HTTPS API, authenticated with a bearer token instead of a browser session.
Available on premium and enterprise plans, switched on per customer.
Your API tokens
Send these as Authorization: Bearer …. Tokens act with your account's permissions, including any organization you belong to, and reach only the endpoints listed below. Each one is shown exactly once — store it somewhere safe.
Create a token
Active tokens
API access is a paid feature
Programmatic access is available on premium and enterprise plans. Everything below describes what it does once your plan includes it.
View plansAPI access hasn't been switched on yet
Your plan includes programmatic access, but we enable it per customer so we can size rate limits and check the endpoints fit what you're building. It's a short conversation, not a queue.
Request API accessAPI access is suspended
Contact usCouldn't load your API tokens
Something went wrong reaching our servers, so we can't show your tokens or confirm your access right now. Nothing has changed on your account — reload the page to try again.
API access is paused
Programmatic access is paused platform-wide for maintenance. Everything you can do through the web app continues to work as normal, and your existing tokens are preserved — they resume working when it's back, with nothing to do at your end.
What you can build
Dynamic QR codes
Create codes, retarget them, pause them, and read their scan history. The printed code never changes, so a campaign can be redirected after it ships.
Document hosting
Upload a PDF, DOCX or PPTX and get back a hosted link and slug, ready to put behind a QR — menus, manuals, price lists, safety sheets.
Digital Product Passports
Create and version passports, bulk import from CSV, export the lot back out. GS1 Digital Link QRs for EU ESPR compliance work.
Organisation analytics
Scan totals with period-over-period change, country and device breakdowns, per-asset leaderboards, CSV export, and the governance audit log.
Brand kits
Read the colours, logo and shape presets saved on your account so anything your own tooling generates stays on brand.
How it works
Create a token, then send it on every request. No SDK, no OAuth dance, no client library to keep up to date — any HTTP client will do.
# List your dynamic QR codes
curl https://qrsansar.com/api/dynamic-qr \
-H "Authorization: Bearer qrs_your_token_here"
# Create one
curl -X POST https://qrsansar.com/api/dynamic-qr \
-H "Authorization: Bearer qrs_your_token_here" \
-H "Content-Type: application/json" \
-d '{"label":"Spring campaign","qr_type":"url","destination":"https://example.com"}'A token reaches the documented endpoints and nothing else. Account settings, billing, team membership and every administrative route stay browser-only, so a leaked token can never be escalated into control of the account.
Rate limits
| Plan | Requests per minute, per token |
|---|---|
| Premium | 60 |
| Enterprise | 300 |
Going over returns 429 with a Retry-After header. Limits can be
raised for a customer with a real need — tell us the shape of your workload.
Getting access
- Be on premium or enterprise. The API isn't available on free accounts.
- Ask us to switch it on. We enable it per customer or per organisation — a short conversation about what you're integrating.
- Create a token on this page and start calling. Access can be attached to your whole organisation, so an integration outlives the person who set it up.
Questions
Who can use the QRSansar API?
Premium and enterprise plans are eligible. Access is then switched on per customer rather than automatically, so we can size rate limits to what you are building and confirm the endpoints you need are covered. Free accounts cannot use the API.
How do I authenticate?
With a bearer token created at /api-tokens. Send it as an Authorization: Bearer header on every request. The token is shown exactly once at creation — we store only a SHA-256 hash of it — and it acts with your account's permissions, including any organisation you belong to.
What are the rate limits?
60 requests per minute per token on premium and 300 on enterprise. Exceeding a limit returns HTTP 429 with a Retry-After header. Limits can be raised for a customer with a genuine need.
Can an API token do everything my login can?
No, and deliberately so. A token reaches only a documented subset of endpoints. Account and session management, billing, team membership changes and every administrative route are reachable from a signed-in browser session only, so a leaked token cannot escalate into control of the account.
What happens if I lose a token, or someone leaves the team?
Revoke it at /api-tokens and it stops authenticating immediately. Tokens cannot be recovered or re-displayed, so a lost token is replaced rather than looked up. Where an integration belongs to the company rather than one person, we can attach API access to your organisation so it survives staff changes.