A VCode is a two-dimensional symbol that identifies one specific thing. It is not a container. It is a reference.
This page covers how the platform works. If you are weighing VCode against a QR code, Data Matrix, NFC or RAIN RFID, start with Why VCode?, which compares them across thirteen dimensions and is candid about where the others win.
The symbol holds no destination
Conventional codes encode their payload into the image. That was a sensible design in the 1990s, when the reader might have no network connection, but it means anyone who photographs the code holds everything it contains, for good. A dynamic QR code softens this by encoding a short URL you control, so the eventual destination can be changed and logged. What it cannot change is that the image still carries a working destination that resolves for anyone holding a copy.
A VCode carries no destination and no readable business payload. It is an opaque reference. Scanning one asks the VPlatform what that specific code refers to. The platform answers according to the record and the rules attached to it. That single change is what makes everything else possible.
What happens during a scan
- Capture. The VCode app or an approved SDK reads the symbol.
- Resolve. The reference is sent to the platform, which identifies the individual code.
- Evaluate. The rules attached to that code are tested: validity period, permitted location, permitted user, remaining uses.
- Respond. An action is returned: content, a credential check, an authenticity result, an entitlement, or a refusal.
- Record. The interaction is written to scan history, whether it succeeded or not.
Closed-loop generation
Authentic VCodes can only be produced by the platform. Only the VCode app or an approved SDK can resolve one and display what it refers to. An attacker cannot manufacture a valid code, and a photographed code is only an image.
Rules the issuer controls
Every code carries its own conditions. Those can include how long it stays live, where it may be scanned, which user or device may present it, and how many times it may be used. Because rules are evaluated centrally at scan time, they can be changed or withdrawn after the code is in the wild.
What a rule can be
The platform evaluates a set of rule types at scan time. Each one can refuse the scan, or run a different action instead, which is why the same code can answer differently rather than simply failing.
| Rule | What it tests | Typical use |
|---|---|---|
| Geofence | Where the scan happened, by radius or polygon | Codes that only work on site |
| Date and time | A date range, and hours within the day | Windows that open and close |
| Platform | Whether the scan came from iOS or Android | A different response per platform |
| Single scan | Whether this code, user or device has scanned before | Once only, once per user, once per day, week, month or year |
| The scanning user, by address or by domain | Restricting a code to named people or one organisation | |
| Invalidate | Whether a named user has already scanned | Withdrawing a code for specific people |
| Boolean | A value supplied with the scan | Branching on something the integration knows |
Separately from the rules, a code can carry a scan budget. Set a number of scans and the code either expires at that point or switches to a different package, so the answer changes on the way through rather than simply stopping. A code can also be given an expiry date.
The code is printed. You are still in control.
This code has already been issued and printed. It cannot be recalled, reprinted or taken back. Change the rule attached to it, scan it repeatedly, and watch the answer change.
Resolving normally. Scans return the record.
Scans so far: 0
Rule in force: expireAfterScans
Nothing about the printed symbol changes. Only what the platform will say about it.
No scans yet. Every attempt will appear here, whether it succeeds or not.
Illustrative only. Times are taken from your own device, and this page does not call the live platform.
Scale and physical constraints
Capacity is not a fixed ceiling. Codes are issued within namespaces, each carrying 72 quadrillion possibilities, and namespaces are added as demand requires, so the system scales rather than running out. The space presently spans approximately 2.2 quintillion identifiers. That is enough to identify individual items rather than product lines. A VCode should be printed at a minimum of 5 mm to remain reliably readable.
Integrating it
Code generation, rules, actions, scan resolution and history are all available programmatically through the VPlatform API. See Developers for how integration works, or talk to us about licensing.