API and MCP server
Generate, validate and render codes from your own systems. The two endpoints nobody else has — scanability scoring and payment-QR validation — are available standalone, without the platform.
- Base URL
- https://api.qrcodegenerator.in/v1
- Auth
- Bearer API key
- Format
- JSON, one envelope
- Spec
- OpenAPI 3.1
curl -X POST https://api.qrcodegenerator.in/v1/qr \
-H "Authorization: Bearer qr_live_..." \
-H "Content-Type: application/json" \
-H "Idempotency-Key: 4f9b21c8" \
-d '{
"type": "url",
"mode": "dynamic",
"name": "Andheri table tent",
"payloadJson": { "url": "https://cafeandheri.in/menu" },
"design": {
"colorsJson": { "fg": "#16161A", "bg": "#FFFFFF" },
"shapesJson": { "dotStyle": "square" },
"frameJson": { "template": "card", "text": "Scan for the menu" }
}
}'
{
"data": {
"id": "qr_8Kp2xR",
"type": "url",
"mode": "dynamic",
"name": "Andheri table tent",
"shortCode": "a8K92x",
"status": "active",
"scanabilityScore": null,
"printLocation": null,
"createdAt": "2026-06-01T09:12:44.000Z",
"updatedAt": "2026-06-01T09:12:44.000Z",
"folderId": null,
"favourite": false,
"campaignId": null,
"domainId": null,
"shortHost": "qrrd.in",
"shortUrl": "https://qrrd.in/a8K92x",
"link": null,
"payload": null
},
"error": null,
"meta": { "requestId": "req_01J8..." }
}curl -X POST https://api.qrcodegenerator.in/v1/validate \
-H "Authorization: Bearer qr_live_..." \
-H "Content-Type: application/json" \
-d '{
"design": { "payload": "https://cafeandheri.in/menu" },
"intendedPrintSizeMm": 22
}'
{
"data": {
"score": null,
"verdict": "not_scored",
"minPrintSizeMm": null,
"notScoredReason": "No score, verdict band or minimum print size is returned. All three are fitted to a 400-sample print-and-scan calibration study that has not been run. Every check below reports what was measured; the six with a standard or a definition behind them also report a state.",
"checks": [
{
"id": "contrast",
"label": "Contrast ratio",
"value": "...",
"state": null,
"stateReason": "Measured, not graded. The threshold for this check is fitted to the 400-sample print-and-scan study, which has not been run — so no pass or fail is claimed.",
"remedy": null
},
{
"id": "quiet_zone",
"label": "Quiet zone",
"value": "...",
"state": "...",
"stateReason": null,
"remedy": "..."
},
{
"id": "logo_obstruction",
"label": "Logo obstruction",
"value": null,
"state": null,
"stateReason": "Not measurable from a finished image. This check reads the design that produced the code, which an uploaded picture no longer carries.",
"remedy": null
}
],
"checksTotal": 18,
"checksGraded": 6,
"decodeMatrix": {
"resolutions": [512, 384, 256, 192, 128],
"degradations": "...",
"results": "...",
"decoders": "...",
"minAgreeing": "...",
"quorumAvailable": "...",
"quorumUnavailableReason": "..."
},
"decodedText": "...",
"measurements": "...",
"engineVersion": "..."
},
"error": null,
"meta": { "requestId": "req_01J8..." }
}curl -X POST https://api.qrcodegenerator.in/v1/payment/validate \
-H "Authorization: Bearer qr_live_..." \
-H "Content-Type: application/json" \
-d '{
"payload": "upi://pay?pa=cafeandheri@okhdfcbank&am=250.5&cu=inr"
}'
{
"data": {
"scheme": "upi",
"params": { "pa": "cafeandheri@okhdfcbank", "am": "250.5", "cu": "inr" },
"verdicts": {
"google_pay": {
"verdict": "fail",
"messages": [
"Google Pay requires the payee name (pn) to be present",
"Google Pay silently uppercases the currency — send uppercase INR to be safe",
"Google Pay rejects amounts without exactly two decimal places"
]
},
"phonepe": {
"verdict": "warn",
"messages": [
"PhonePe auto-rounds to two decimals — send the exact amount to avoid surprises"
]
},
"paytm": {
"verdict": "warn",
"messages": [
"Paytm falls back to showing the raw VPA when the payee name is missing"
]
},
"bhim": {
"verdict": "pass",
"messages": []
},
"amazon_pay": {
"verdict": "pass",
"messages": []
}
},
"summary": "1 wallet(s) will reject this code (google_pay) — fix before printing."
},
"error": null,
"meta": { "requestId": "req_01J8..." }
}{ "data": {}, "error": null, "meta": { "requestId": "..." } }Input is validated with a schema and rejected with 422 plus per-field errors. Idempotency keys on every POST. Cursor pagination. Rate limits in X-RateLimit-* headers.
- Pro
- 50,000 calls/mo · 60 rps
- Business
- 500,000 calls/mo · 120 rps
- Agency
- 2M calls/mo · 240 rps
- Enterprise
- Custom · negotiated burst
Buy the verification without the platform
Print shops, packaging houses and fintechs mostly do not want a QR dashboard. They want to know whether a code will scan, and whether a payment URI is correct, inside their own pipeline. Both are priced as standalone API products.
Scanability as a service
Send an image or a set of design parameters, get the 18-point report, the decode matrix. Minimum print size: returned once the print study is complete.
Print shops validating client artwork · packaging houses gating a run · design tools embedding a pre-flight check.
Payment-QR correctness
Validate a UPI, PIX, QRIS or EPC URI against the spec and against each wallet’s real parser behaviour, with field-level errors.
Fintechs generating merchant QRs · POS vendors · anyone printing payment standees at volume.
The full surface
31 of 31 paths below are live on the API today. The rest are marked Coming; this count is generated from the running app, so it cannot drift from what is deployed.
Twelve tools for AI agents
Every MCP tool is a thin forward to a REST endpoint you already have, with your API key passed through verbatim — same org scope, same rate limits, no separate business logic. Ask an assistant to check a UPI QR before you print five hundred of them.
10 of 12 are implemented, read from the server's own tool list.
{ "mcpServers": { "qrcodegenerator": { "command": "qrcg-mcp", "env": { "QRCG_API_KEY": "qr_live_..." } } } }The server is in early access — what it does and how to get it Generated from the spec, every release
The OpenAPI 3.1 document is generated from the code, never hand-maintained, and nine SDKs are generated from it on every minor release — so a client library can never drift from the API it wraps.
- TypeScript
- Node
- Python
- PHP
- Laravel
- Go
- Java
- .NET
- Ruby
- qr.scanned
- A code was scanned — geo, device and rule matched
- qr.created
- A code was created, by API or in the app
- qr.updated
- Name, design or settings changed
- qr.destination_changed
- A dynamic code was retargeted, with the previous value
- bulk.completed
- A bulk job finished, with the score distribution
- form.submitted
- A landing-page form received a submission
- link.clicked
- A short link was followed
- subscription.*
- Plan, payment and entitlement changes
HMAC-signed, delivered from a durable queue with backoff and dead-lettering. Auto-disabled after sustained failure. Your handlers must be idempotent — retries are expected, not exceptional.