Business Plan: Complete Guide

Business Plan Overview

The Business plan unlocks the full ScanOrbit platform: developer APIs, signed webhooks, white-labelled scan pages, and geo-targeted redirects. This guide covers every feature and how to activate it.

API Access

The ScanOrbit REST API lets you create, update, delete, and fetch analytics for QR codes from any application or script. API access is exclusively available on the Business plan.

Step 1: Generate an API key

Go to Dashboard → Settings → API Keys. Name the key (e.g., "Zapier", "Production Service"), choose its access and expiry, click Generate, and copy the key immediately. It is shown only once: ScanOrbit stores only a fingerprint of it, so it can't be shown again.

Full access keys can create, change and delete QR codes. Read only keys can list codes and read analytics, and get a 403 KEY_READ_ONLY for anything else, which suits dashboards and reporting tools. Keys can expire after 30 days, 90 days or 1 year; an expired key gets 401 KEY_EXPIRED.

Step 2: Authenticate your requests

Pass your API key in the X-API-Key header on every request.

curl -X GET \
  "https://brrtnzrdqgpmddvvppql.supabase.co/functions/v1/make-server-d9709a44/api/v1/qrcodes" \
  -H "X-API-Key: qrk_your_key_here"

Rate limits

Business plan API keys are rate-limited to 120 requests per minute. If you exceed this, you will receive a 429 Too Many Requests response with a Retry-After: 60 header. Every response includes X-RateLimit-Limit and X-RateLimit-Remaining so you can pace requests.

Endpoints

{ "data": [{ "id": "...", "name": "Summer Menu", "type": "url",
  "shortCode": "summer-menu", "active": true,
  "totalScans": 1247, "createdAt": "2026-05-12T10:30:00Z" }] }

{ "data": { "id": "...", "name": "Summer Menu", "content": "https://example.com/menu",
  "totalScans": 1247, "uniqueScans": 982, "scansByDay": [...] } }

{ "name": "New QR", "type": "url", "content": "https://example.com" }

{ "data": { "id": "...", "shortCode": "new-qr-a1b2c3", "active": true } }

{ "content": "https://example.com/new-page", "active": true }

{ "data": { "id": "...", "updatedAt": "2026-07-05T10:00:00Z" } }

{ "data": { "deleted": true, "id": "..." } }

{ "data": { "totalScans": 1247, "uniqueScans": 982,
  "scansByDay": [...], "scansByCountry": [...],
  "scansByDevice": [...], "scansByBrowser": [...] } }

Full working example

// Node.js / JavaScript
const API_KEY = "qrk_your_key_here";
const BASE = "https://brrtnzrdqgpmddvvppql.supabase.co/functions/v1/make-server-d9709a44";

// Create a QR code
const res = await fetch(`${BASE}/api/v1/qrcodes`, {
  method: "POST",
  headers: {
    "Content-Type": "application/json",
    "X-API-Key": API_KEY,
  },
  body: JSON.stringify({
    name: "Product Page",
    type: "url",
    content: "https://yoursite.com/product",
  }),
});
const { data } = await res.json();
console.log("Created:", data.id, data.shortCode);

// Update its destination
await fetch(`${BASE}/api/v1/qrcodes/${data.id}`, {
  method: "PATCH",
  headers: { "Content-Type": "application/json", "X-API-Key": API_KEY },
  body: JSON.stringify({ content: "https://yoursite.com/new-product" }),
});

Webhooks

Webhooks send a signed HTTP POST to your server when someone becomes a lead or a contact (not on passive scans). These verified events are built to trigger CRMs, databases, and automated workflows.

Setting up a webhook

1. Go to Dashboard → Settings → Notifications.
2. Paste your HTTPS endpoint URL in the Webhook URL field.
3. Click Save. A signing secret is automatically generated and displayed.
4. Copy the signing secret: you will need it to verify incoming payloads.

Supported events

• form.submitted: a Lead Capture Form, custom page form, or Feedback rating was submitted
• lead.captured: someone saved contact details on a Digital Business Card

Payload structure

{
  "event": "form.submitted",
  "qrId": "a1b2c3d4-...",
  "shortCode": "summer-menu",
  "qrName": "Summer Menu",
  "type": "leadform",
  "values": { "Name": "Alex Chen", "Email": "alex@example.com" },
  "timestamp": "2026-07-05T14:23:11.000Z"
}

Verifying signatures

Every webhook includes an X-ScanOrbit-Signature header in the format t=<timestamp>,v1=<hex_signature>.

The signature is calculated as HMAC-SHA256(secret, "{t}.{rawBody}"). Verify it on your server to reject spoofed requests.

// Node.js: Express webhook handler
const crypto = require("crypto");

app.post("/webhook", express.raw({ type: "application/json" }), (req, res) => {
  const sig = req.headers["x-scanorbit-signature"] || "";
  const [tPart, v1Part] = sig.split(",");
  const t = tPart?.split("=")[1];
  const v1 = v1Part?.split("=")[1];

  const secret = process.env.WEBHOOK_SECRET;
  const expected = crypto
    .createHmac("sha256", secret)
    .update(`${t}.${req.body}`)
    .digest("hex");

  if (expected !== v1) {
    return res.status(401).send("Invalid signature");
  }

  // Signature valid: process the event
  const event = JSON.parse(req.body);
  console.log(event.event, "on", event.qrName, event.values || event.email);

  res.sendStatus(200);
});

Zapier

ScanOrbit has its own Zapier app, so you can connect it to thousands of other tools without writing code or setting up webhooks.

Connect it

1. Open the ScanOrbit Zapier invite and accept it. This adds the app to your Zapier account. 2. Create an API key under Settings → API Keys. A read-only key is enough for triggers; to create or update codes from Zapier, give it write access. 3. In Zapier, make a Zap, choose ScanOrbit, and paste the key when asked to connect.

What it can do

Instant triggers: New Lead (someone shares their details on your digital business card), New Form Response (a form, survey, poll or feedback page is submitted), New QR Code, and New Scan. Actions: Create QR Code, and Update QR Code to change where a printed code points, rename it or pause it. Search: Find QR Code by name or short code.

Zapier counts each run of a Zap against your Zapier plan's tasks; ScanOrbit doesn't charge for it. New Scan runs on every scan, so for busy codes add a Filter step for the codes you care about. Turning a Zap off, or deleting the API key it uses, stops ScanOrbit sending it events.

Geo-targeting

Geo-targeting redirects scanners to different URLs based on their country of origin. This is ideal for international marketing, multilingual landing pages, and localized promotions.

Configuration

1. Open a Website URL QR code.
2. Navigate to the Geo-targeting section.
3. Add routing rules for target countries and specify individual destination URLs.
4. Set a Fallback URL for non-specified countries.
5. Save changes to apply instantly.

Retargeting Pixels

Attach Facebook, Google, or TikTok tracking pixels to dynamic QR codes. Pixels execute on redirect, capturing high-intent physical scanners directly into your retargeting audiences.

Supported platforms

• Meta Pixel (Facebook/Instagram): fires a standard PageView event
• Google Analytics 4: streams events directly to your Measurement ID (G-XXXXXXXXXX)
• TikTok Pixel: records scan conversions into TikTok Ads Manager

White-label Branding

Replace ScanOrbit branding across all hosted micro-pages (Landing Pages, Feedback Forms, Digital Business Cards) with your corporate identity.

Custom Domain

Route short URLs through your branded subdomain (such as go.yourcompany.com/r/code) instead of the default domain.

Setup steps

1. In your DNS provider, create a CNAME record pointing your subdomain (e.g. go) to scanorbit.app.
2. Confirm DNS propagation via dnschecker.org .
3. Email hello@scanorbit.app to request SSL provisioning and subdomain routing activation.

A/B Split URL Testing

Distribute traffic probabilistically across two or more landing page destinations using Smart Routing rules to determine which offer or creative generates higher conversion rates.

Bulk Import & Export

Generate up to 500 QR codes in a single batch via CSV upload. Export your full inventory and scan analytics anytime for external reporting.

Sample CSV format

name,type,content,displayUrl
Summer Promo,url,https://yoursite.com/summer,yoursite.com/summer
Product A QR,url,https://yoursite.com/product-a,yoursite.com/product-a
WiFi Guest,wifi,WIFI:T:WPA;S:GuestNetwork;P:password123;;,GuestNetwork
Contact Card,vcard,BEGIN:VCARD\nVERSION:3.0\nFN:Jane Smith\nEND:VCARD,Jane Smith

Analytics & Reporting

Business plan accounts include unlimited lifetime analytics history with full geographic, device, and time-of-day breakdowns.