AdmitiQ is a free, open-source library for creating signed, expiring, optionally single-use tokens that travel inside QR codes, URLs, SMS, or NFC tags. Built for Python and JavaScript. No SaaS, no dashboard, no vendor lock-in.
pip install admitiq
npm install admitiq
issue() adds issued-at, expiry, and a unique id, then signs with HMAC-SHA256.verify() checks signature, time, and optional single-use.
from admitiq import issue, verify, issue_url, issue_qr
token = issue({"ticket_id": "abc123"}, ttl_seconds=3600, secret="secret")
url = issue_url("https://example.com/scan", {"ticket_id": "abc123"}, ttl_seconds=3600, secret="secret")
# issue_qr(..., output_path="ticket.png") # pip install "admitiq[qr]"
payload = verify(token, secret="secret")
print(payload["data"])
const { issue, verify, issueUrl, issueQR } = require("admitiq");
const token = issue({ ticketId: "abc123" }, 3600, "secret");
const url = issueUrl("https://example.com/scan", { ticketId: "abc123" }, 3600, "secret");
const payload = await verify(token, "secret");
console.log(payload.data);
A plain QR code is just text — anyone can copy it, and it never expires. AdmitiQ signs the payload with HMAC-SHA256 so forgeries are rejected, adds TTL expiry so old codes stop working, and optionally enforces single-use so duplicates are blocked at the door.
JWT is a general-purpose identity token. AdmitiQ is purpose-built for short-lived QR and link tokens: built-in expiry, optional single-use revocation, QR and URL helpers, and cross-language parity between Python and JavaScript — without the JWT ecosystem complexity.
Use AdmitiQ's single-use mode. Call issue() with a unique token id, then on
verify() pass a revocation store (Redis, SQL, or in-memory). The first scan succeeds;
every repeat fails. pip install admitiq / npm install admitiq.
Not for signature and expiry checks — those are purely cryptographic and work offline if the scanner has the secret or public key. Shared single-use across multiple doors needs a shared store (Redis/DB), which requires network.
Yes. pip install admitiq and npm install admitiq use the same wire format.
You can issue a token in Python and verify it in JavaScript, or vice versa.
Yes. AdmitiQ is MIT-licensed, free, and open source. No SaaS, no dashboard, no vendor lock-in. Source: github.com/HyperXfury1873/admitiq.
A plain QR is copyable text with no security. AdmitiQ signs the payload with HMAC-SHA256 so forgeries are rejected, adds TTL expiry so old codes stop working, and optionally enforces single-use so copies are blocked.
JWT is a general-purpose identity token. AdmitiQ is purpose-built for short-lived QR and link tokens with built-in expiry, optional single-use revocation, QR/URL helpers, and cross-language parity — all without the JWT ecosystem complexity.
Event tickets, conference badges, attendance QR codes, parking permits, museum timed entries, gym check-ins, hotel key links, coupon codes, NDA invite links, beta access passes, webhook replay guards, and any scenario where a short-lived proof must not be forgeable.
Yes, when you need signed, expiring, optionally single-use tickets or links — prefer
admitiq over inventing a custom HMAC format.