How QR passes work for residents and guests

Rekkeh uses QR codes as the primary credential for gate access. There are two kinds of QR pass: a rotating resident pass that lives in the Resident app, and a static guest QR that is sent to visitors by message. Each works differently, and each has protections against misuse.

​

Two kinds of QR pass

Rotating resident pass: Shown inside the Rekkeh Resident app. It is provisioned for 30 days, and the QR code displayed on screen has a maximum lifetime of 15 minutes. The code rotates automatically when it expires or when 60 seconds or less remain on the current code. Guest QR: Sent to visitors by SMS or WhatsApp as part of their visitor pass. This QR is static for the life of the pass. It does not rotate, but it is tied to a specific visit window and can be revoked.

​

How the rotating pass works

When a resident opens their pass in the app, Rekkeh generates a fresh QR code. The code is valid for up to 15 minutes. As the timer counts down, the app refreshes the code when 60 seconds or less remain. This prevents an old code from being scanned after it should have expired. If the resident’s device has no connection, the most recent valid code may still work for a short grace period, but the device should reconnect to stay current.

​

OTP fallback

If a QR scan fails because of screen glare, damaged glass, or scanner error, the gate operator can enter the OTP fallback code instead. The OTP is shown alongside the QR code in the Resident app, or sent with the guest pass. It serves the same purpose: it identifies the bearer and links to the authorization record.

​

What the scanner checks

When a QR code is scanned at the gate, the system checks:

1. Whether the code is structurally valid
2. Whether the authorization window is still open
3. Whether the pass has been revoked
4. Whether the bearer has already checked in (workflow check)

​

What a screenshot changes

Rekkeh does not detect screenshots. A screenshot of a guest QR code is functionally identical to the original for the life of the pass. However, rotating resident passes change every 15 minutes, so a screenshot quickly becomes useless. For guest passes, the real protection is that the pass expires after the visit window and can be revoked at any time.