Why a paper voucher needs a QR code in 2026
A voucher isn't decoration. It's a contract between operator and supplier for one specific service. A QR code turns a static piece of paper into a living status.
Every tour operator has lived this scene. The guide arrives at the meeting point. The customer hands over a voucher. The guide opens WhatsApp — and there's a voucher from last week, for a different group with a similar name. Ten minutes of confused checking later, it turns out yes, this voucher is current, the guide just forgot to verify the date.
That's normal. The guide isn't to blame. The voucher is to blame: it's paper, it's static, and it can't tell you "I'm fresh, I was issued today, I'm for this group."
What a voucher is, technically
The simple version is a PDF with credentials: code, supplier, service date, pax count, operator contact. It serves two purposes simultaneously: for the customer, proof the service is paid for; for the supplier, instruction to deliver said service.
The weakness in both purposes is staticness. A voucher issued in April for a service in September. Anything can happen in those five months: the booking is cancelled, the deposit didn't clear, the supplier is replaced, the date is moved. Paper doesn't know.
What changes with a QR code
A QR is just a URL. The supplier scans it, lands on a public status page that shows the current state of the voucher: valid / consumed / cancelled. No login, no app — standard phone camera plus browser.
That gives you three new capabilities you didn't have on paper.
Real-time validation at the service. The guide scans the voucher before starting the tour, sees "valid, paid, 8 pax", and gets to work. If the voucher was cancelled, the guide sees that immediately, not after spending ninety minutes with an unpaid group.
Duplicate protection. One QR per voucher. If somebody printed a copy or forwarded the PDF, the server still knows which voucher was the original issued, and won't let two consume the same slot.
Automatic supplier reconciliation. Every scan leaves a trace. At month end you know which vouchers were actually presented and which weren't — that's a verifiable supplier reconciliation, no phone calls or spreadsheet diffs.
What a properly built QR voucher needs
A few pragmatic requirements that turn obvious by the fifth time:
The QR points at a short, stable URL. Don't try to encode all the information into the QR — long QRs are awkward and scan poorly on a wrinkled printout. Twenty-thirty token characters in the URL is plenty.
The token is unpredictable. Not a sequential voucher #42 — cryptorandom, e.g. 24 bytes in base64url (192 bits of entropy). Otherwise someone could brute-force live vouchers.
The public endpoint returns minimum data. Supplier name, status, pax count, service time — yes. Customer name, phone, passport, price — no. The supplier doesn't need to know the price, the guide doesn't need passport details. Anything more is a PII leak.
A status FSM with one correct trajectory. draft → issued → delivered → consumed, and cancelled from any non-terminal state. No "consumed → issued" because you physically can't un-deliver a delivered service.
Audit log on every transition. Who issued, who cancelled, who marked it consumed. That history isn't for you — it's for your accountant, and in rare cases, for a court.
How it's wired in INITE Travel
We just shipped this in Phase 10. Each voucher gets a unique code like V-2026-0042 (sequential per company) and a cryptorandom qrToken (192 bits). PDFs render via @react-pdf/renderer, the QR is generated by the qrcode npm package as a PNG dataURL embedded directly in the document.
The public endpoint /api/vouchers/verify/[qrToken] returns a JSON status with basic credentials, no auth required. Supplier scans — supplier sees the answer. No registration, no app.
The PDF is also fetchable by the same token: ?token=qrToken instead of ?companyId=.... That way you can forward the voucher to the customer over WhatsApp / Telegram / email, and they open the PDF without needing a back-office login.
Bonus: bulk generation. One click in the booking record, and the system walks the entire itinerary and creates a draft voucher per service (transfer, hotel, guide, activity). Idempotent: clicking twice doesn't create duplicates.
If you're not on this yet — main advice: even a homemade QR voucher pointed at a static HTML status page gives you 80% of the benefit of a full system. An hour of work, and your suppliers stop calling you.