Subscription Pass + QR Redemption
A working slice of the real architecture: a subscriber buys a monthly pass, the server issues a signed QR token, a machine validates it server-side and dispenses, and regenerating the QR instantly invalidates the previous code. No paid plugins, no client-trusted state.
1. Get a pass
Two ways to try it:
How it works
- Buy a monthly pass. In Stripe mode this is a real Checkout subscription (test mode); the entitlement version is stored on the Stripe subscription, so Stripe is the single source of truth.
- Pass page shows a QR that encodes a server-signed token (it carries only an opaque id + version, nothing trusted from the browser).
- Redeem at the machine: the server checks the signature, that the subscription is active, and that the QR is the current version, then approves the dispense.
- Regenerate bumps the version, so the old QR immediately stops validating.