Get through the door
Turn a ticket into a wallet pass, then get scanned green on the night.
Owned by Member · 8 steps · about 10 minutes
Why this exists
A ticket is an entitlement in the database. A pass is the physical-world credential minted from it, and the two are deliberately separate rows: the ticket can survive changes of ownership that the pass must not.
Every credential is signed, and the QR code rotates — it is derived from a per-pass secret and the current time step, so a screenshot someone sent a friend is worthless within a minute. The NFC payload is signed with a key that can be rotated venue-wide. This is why a red scan is almost never "the phone is broken": it is a specific, logged reason.
The other half of the design is that revocation is terminal. When a ticket is resold or refunded, the old pass is revoked, its serial and payload hash are blacklisted and its secret is killed — and a new pass is minted for the new owner. The old credential does not merely stop working; it fails loudly with a reason the door can read out.
Before you start
- A paid order with at least one issued ticket (see 'Buy a ticket').
- For the door half: an employee session (door staff, venue manager or admin).
Practise with
| Persona | Password | Note | |
|---|---|---|---|
| member | member@club.test | member123 | the ticket holder |
| door_staff | door@club.test | door123 | works the scanner |
| venue_manager | manager@club.test | manager123 | sees the scan logs and the readers |
Steps 1–4 — Member
their manual →-
1Find the ticket you bought.Expected result The ticket with its event and tier.Watch out for A ticket does not automatically have a pass. Issuing the door credential is the next step and it is yours to do.
-
2Open your wallet. This is where every credential you hold lives — event passes and, if you have one, your membership card.Expected result Your passes with their status and the zones each one opens.
-
3Add the pass to Apple Wallet (or use the Google variant next to it).Expected result A downloadable pass file; the platform records a wallet registration so it can push updates to it later.Watch out for The wallet copy is not a snapshot. If the pass is later suspended or revoked, a push updates or voids the copy in your phone.
-
4Look at the rotating QR fallback — the thing you actually hold up if the NFC reader is having a bad night.Expected result A QR payload that changes on a short time step.Watch out for It rotates. A screenshot taken earlier will scan red, and that is the point, not a bug.
Steps 5–6 — Door Staff
their manual →Scans the credential and reads the verdict out loud.
-
5On the door, open the scanner, pick your reader, and scan the guest's phone.Expected result A full-screen green or red verdict readable at arm's length.Watch out for The scanner is gated to the employee pseudo-group — door staff, venue manager or admin. It is the only staff surface most door staff ever need.
-
6Understand what the scan actually did: it validated the signature, checked the pass is active, checked the event window and zone, and checked nobody has already walked in on this credential.Expected result Green with the holder and zone, or red with a specific reason code.Watch out for This endpoint is authenticated by the READER's device token, not by your login. That is what lets a provisioned door device keep scanning when the network drops and it has no session.
Steps 7–8 — Venue Manager
their manual →Investigates a red scan from the access dashboard.
-
7When a guest insists their ticket is fine, open the access dashboard rather than arguing at the door.Expected result Readers, signing keys, revocations and recent scans.
-
8Look up the actual scan and read the reason code: already used, wrong event, outside the door window, suspended because the ticket is listed for resale, or revoked.Expected result The scan history for that pass, with the verdict and reason on each row.Watch out for 'Listed for resale' is the one that surprises people. Listing a ticket suspends its pass on purpose — you cannot sell it and also walk in on it.