Initial situation: checkout line, printed QR code, changing payment methods
The restaurateur has a printed QR code at every table. Guests should pay quickly by smartphone — however, the payment options change regularly (new PSPs, promo codes, tipping rules). A static QR code that points directly to a provider’s payment page is rigid and inflexible. The ideal solution is a dynamic QR workflow that, on scan, triggers a payment, informs the POS and automatically marks the order as paid.
Why dynamic QR codes with webhooks and APIs make sense here
Dynamic QR codes decouple the printed medium from the destination: the printed code stays the same, while the destination (payment page, checkout flow, fallback) can be changed at any time. Combined with webhooks and API calls, this enables automated flows: scan → webhook/API → create/confirm an order → redirect to the payment page or attempt a direct payment. Centrally managed in a system like Linkentra, the target can be adjusted quickly, media/branding maintained and scan statistics reviewed.
3 practical workflow variants
Variant A — Orchestrator redirect (recommended for flexible payment integration)
Architecture: QR → Linkentra (short/target) → your orchestrator (public endpoint) → POS/PSP → redirect to the payment page.
- On scan, Linkentra forwards to your orchestrator (or sends a webhook notification to it).
- The orchestrator creates an order line in your POS via API, creates a payment object at the PSP and returns a payment URL.
- The orchestrator redirects the customer to the payment page; after payment is received the PSP notifies your POS via callback and your system marks the order as paid.
Variant B — Linkentra webhooks as trigger (minimal changes)
Architecture: QR (Linkentra) → direct redirect to a static payment page; Linkentra simultaneously sends a webhook to the POS/orchestrator.
- Linkentra manages the QR and redirects to the payment page (e.g., PSP checkout).
- At the same time a webhook is sent to your backend URL which creates the order in the POS and waits for payment.
- After successful payment your system reconciles and completes the order.
Variant C — Scan → direct payment (highest automation, PSP-dependent)
Architecture: QR → orchestrator → API call to PSP for instant payment (e.g., QR-based wallet) → order completion.
This variant requires that your PSP offers an API for immediate payments (without an intermediate page). Advantage: the customer needs to click less; disadvantage: higher demands on security, refund processes and integration effort.
Concrete webhook example payloads
These payloads are examples that help your POS/Orchestrator create orders and link payments.
Scan event (sent on scan):
{
"event": "scan",
"qr_id": "qr_12345",
"scan_id": "scan_67890",
"timestamp": "2026-10-28T12:34:56Z",
"client_ip": "203.0.113.42",
"user_agent": "Mozilla/5.0 (iPhone; CPU iPhone OS 15_0 like Mac OS X)",
"location": {"lat": 48.137154, "lng": 11.576124},
"metadata": {"table": "T12", "staff_id": "u42"}
}
Order-created callback (your system to Linkentra/logic):
{
"event": "order_created",
"order_id": "ord_20261028_0001",
"qr_id": "qr_12345",
"amount": 18.90,
"currency": "EUR",
"payment_url": "https://pay.provider/checkout/abcde",
"expires_at": "2026-10-28T12:50:00Z"
}
In the simple scenario, Linkentra redirects directly to the payment_url after the scan or your Orchestrator does that. In more complex setups, your backend uses the scan payload to initialize order and payment in parallel.
Security hardening — basic rules for webhooks & API
- Enforce TLS: All endpoints must use HTTPS with up-to-date TLS versions.
- Authentication: Use a shared secret for webhooks and verify signatures (e.g., HMAC-SHA256 over the payload with an X-Signature header).
- IP filtering & rate limiting: Whitelist known sender IP ranges and rate-limit incoming requests to prevent abuse.
- Replay protection: Accept webhook events only with unique IDs and discard duplicate or too-old timestamps.
- Principle of least privilege: Grant API keys and service accounts only the permissions strictly required.
- Audit logs and encryption: Store sensitive data encrypted; log accesses and changes completely.
Example: Verifying an HMAC signature (conceptual)
signature = header['X-Signature'] computed = HMAC_SHA256(shared_secret, request.body) if not constant_time_compare(signature, computed): reject 401
Monitoring & operations: How to keep the system reliable
- Health checks: Expose endpoints for liveness/readiness and have them monitored by a load balancer.
- Webhook retries: Implement a retry policy with backoff and a dead-letter queue for events that cannot be processed.
- Dashboards & alerts: Visualize metrics such as webhook latency, error rate, success rate of payment redirects, and scan volume in dashboards (e.g., Grafana); configure alerts via Slack/email/SMS.
- Test environment: Use staging QR codes and a test webhook URL to validate integrations without running in production.
- Rate & spike protection: Provide safeguards against seasonal or peak load spikes (events, lunch hours).
Deployment checklist — short
- Create QR design & branding in Linkentra (SVG/PNG export for printing).
- Provide the orchestrator endpoint (TLS, auth, logging).
- POS API integration: define endpoints for order-create, order-update, payment-confirm.
- Implement webhook handling: signature verification, idempotency, DLQ.
- Set up monitoring: health checks, dashboards, alerts.
- Test staging: run the complete payment loop and simulate error cases.
Short practical example
A café uses Linkentra to manage QR codes on the tables. On scan, Linkentra either redirects directly to the PSP checkout page (Variant B) or to an orchestrator that coordinates order and payment (Variant A). The POS register immediately receives an order ID via webhook with table and scan metadata; after payment is received the register automatically marks the order as paid, and issuance of invoice and receipt happens without manual intervention. Operators benefit from centralized control of QR targets, the ability to adjust payment destinations, and scan statistics for analysis.
Conclusion & recommendation
With dynamic QR codes, webhooks and API workflows, payments at the POS can be significantly accelerated and administrative steps automated. Crucial are a clear orchestrator architecture, proper security measures and robust monitoring. Linkentra can handle centralized management of QR codes — in both cloud and self-hosted setups — enabling changes to target URLs, branding and fallbacks without reprinting.
Get started now: Explore Linkentra and determine which variant (orchestrator redirect vs. webhook trigger) best fits your register and payment architecture. Discover Linkentra
Next step
Try Linkentra yourself
Dynamic QR codes with control over hosting and data: change content afterwards, adjust branding, manage media centrally and analyze scans – optionally on your own infrastructure (Self‑Hosted) or immediately in the Linkentra Cloud. Edition-dependent features for teams, API and white‑label.