When the technician may enter for only two hours — but the lock stays unchanged
A janitorial service, an IT technician or an emergency crew needs access to a property — but only for a limited time. Handing out keys is cumbersome, access cards are expensive and temporary PINs can be shared and reused. Printed QR codes on doors are convenient, but how do you prevent the same code from being misused later?
The solution: dynamic, time‑limited or single‑use access QR codes with server‑side validation and audit logs. This way the physical QR sticker remains permanent, while the underlying target, validity and reporting can be centrally controlled — optionally on your own infrastructure.
How temporary access QR codes work
A dynamic QR code does not point directly to a fixed URL, but to a shortlink target whose behavior you define in a management system. For access scenarios three mechanisms are particularly important:
- Expiration date / time window: The link is active only within a defined period (e.g. 09:00–11:00 on 12.11.).
- Single‑use: After the first valid scan the link is deactivated or redirected to a fallback.
- Server‑side validation & audit: Every scan is logged, and before a locking system reacts it queries the server via API/webhook for validity.
Practical example: Building cleaner with shifting schedules
Situation: A cleaning company services several office locations. Cleaning staff rotate daily, and key management is time‑consuming. Printed QR stickers at service entrances are in place.
Steps to implement:
- For each shift the dispatcher in the admin creates a dynamic QR target with a time window and an optional single‑use rule.
- The cleaner scans the door QR; the access system queries the server for validity via webhook/REST.
- On a valid scan the door opens, and the server logs time, user identifier and result for audit logs.
Benefits: No new stickers per shift, centrally controllable validities, traceable access logs.
Technical integration: Webhooks, API and real‑time validation
Critical is the server‑side response before a barrier is opened. A typical integration architecture:
- The access device (lock controller, door reader) sends a request to an internal middleware service when scanned.
- The middleware queries the QR management system via API or webhook to determine whether the shortlink is currently valid, already used or expired.
- Based on the response the access device decides: open / deny. At the same time an audit log is written.
Important: The response must be deterministic and fast. Use short timeouts, caching for unchanged rules and secure authentication (API‑Keys, HMAC).
Self‑Hosted vs Cloud: Who Should Choose Which?
Data sovereignty plays a central role in access control. Two operational models are available:
- Self‑Hosted: The system runs on your own infrastructure. Ideal when compliance, GDPR, or internal security requirements demand strict control. You retain logs, access control and integration endpoints entirely in‑house.
- Cloud: Fast commissioning, hosted updates and lower administrative effort. Suitable for smaller operators or when the infrastructure should not be managed in‑house.
Many operators use a hybrid approach: run core functions like validation and audit locally, and use the cloud for supplementary media management or reporting.
Linkentra in Practice: Relevant Features
With Linkentra you generate dynamic short links/QR targets that can be set to expire or be single‑use. Relevant features for access use cases include:
- Dynamic targets with time control and fallback options.
- Single‑use configurations so a link is automatically disabled after a successful scan.
- Server‑side scan statistics and audit logs to trace access events.
- Webhooks and API interfaces for integration with door controllers and middleware.
- Self‑Hosted installation for full data sovereignty as well as a cloud option for quick start.
- Export options (PNG, SVG) and branding tools to create branded door stickers or service IDs.
Depending on the edition (BASIS, PRO, WHITE‑LABEL), features for teams, bulk import or extended integrations are available.
Implementation Plan in 6 Steps
- Define the use case: Who needs access, for how long and to what extent?
- Select the system: Decide self‑hosted vs cloud based on compliance and maintenance requirements.
- Create QR targets: Configure time windows, single‑use, and fallback URL.
- Implement the integration interface: Connect webhook/API with the access controller and set up authentication.
- Test audit logs: Simulate scans, verify the audit trail for completeness and accuracy.
- Start operations: Establish processes for issuance, deactivation and emergency procedures.
Checklist: What to Check Before Rollout
- Validity windows are correct and configured in the local time zone.
- Single‑Use rules work even during network interruptions (fallback behavior defined).
- Secure API authentication (no open endpoints).
- Audit‑log retention complies with compliance requirements.
- Emergency process: manual opening in case the validation instance fails.
- Documentation for service providers and the internal team is available.
Common pitfalls and how to avoid them
Source of error: excessively long timeouts when querying the API. Result: the door stays closed because the request is waiting. Solution: short timeouts and local failover rules.
Source of error: no test data for single‑use. Result: link is not deactivated correctly. Solution: test workflow for first use and reset mechanisms before going live.
Source of error: unclear responsibilities with self‑hosting. Solution: define an operation manual, team roles and monitoring for the validation API.
Conclusion and recommendation
Temporary access QR codes reduce administrative effort, increase traceability and give you the flexibility to centrally control validity — without printing new stickers or expensive access housings. Critical for secure operation are short validation paths, robust audit logs and clear emergency procedures.
If you need control over hosting, logs and integrations, a system with a self‑hosted option is advisable. With solutions like Linkentra you can directly use dynamic targets, single‑use rules, webhooks and audit statistics and integrate them into access or locking systems.
Discover Linkentra: Create time‑limited or single‑use QR targets, integrate webhooks for real‑time validation and retain full data sovereignty through self‑hosting. Start the integration with clear test runs and a secured API connection: Linkentra entdecken.
Next step
Try Linkentra yourself
Dynamic QR codes with control over hosting and data: change content afterwards, adjust branding, manage media centrally and evaluate scans — optionally on your own infrastructure (self‑hosted) or immediately in the Linkentra Cloud. Edition‑dependent features for teams, API and white‑label.