Understanding QR Code Login: Principles, Token Authentication, and Implementation Steps

In daily life QR codes appear in many scenarios such as supermarket payments, system login, and app downloads. Understanding their principles provides technical staff with new ideas for technology selection and helps non‑technical users recognize and avoid fraudulent QR codes.

Essence of QR Code Login

QR code login is essentially a form of authentication that must accomplish two tasks: telling the system who you are and proving it to the system.

Identify the user (e.g., account name or phone number).

Prove the identity (e.g., password, verification code, or QR‑based confirmation).

When a mobile app scans a PC‑generated QR code and the user confirms, the account on the mobile device is logged into the PC.

Understanding QR Codes

QR codes are similar to barcodes but can store any string, not just numbers. They can be generated from text, URLs, files, etc., and can be decoded back into the original content.

System Authentication Mechanism

The login process relies on a token‑based authentication mechanism. When a user logs in with username and password, the client sends device information to the server, which binds the account with the device and generates a token.

const token = {
  acountid: '账号ID',
  deviceid: '登录的设备ID',
  deviceType: '设备类型，如 iso,android,pc......'
}

The client stores this token locally and includes it in subsequent API requests. The server validates the token by comparing the stored device information with the information sent by the client.

General Steps of QR Code Login

Overall Flow

Before scanning, the mobile app is already logged in; the PC displays a QR code awaiting scan.

The mobile app scans the QR code and prompts the user to confirm.

After confirmation, the PC logs in successfully.

QR Code Preparation

PC requests the server to generate a QR code and sends its device info.

Server creates a unique QR‑code ID and binds it to the PC’s device info.

Server returns the QR‑code ID to the PC, which generates the QR image containing the ID.

PC polls the server periodically to obtain the QR code’s status.

Scanning State Transition

The mobile app scans the QR code and extracts the QR‑code ID.

The app sends the user’s identity and QR‑code ID to the server.

The server binds the identity to the QR‑code ID and returns a temporary token to the mobile app.

Because the PC is polling, it updates the QR code status to “scanned”.

The temporary token is a one‑time credential used by the mobile app in the next step to ensure the scan and login originate from the same device.

Status Confirmation

The mobile app shows a confirmation screen; upon user approval, it sends the temporary token to the server.

The server generates a final login token for the PC based on the bound account and device information.

The PC receives the “confirmed” status and the login token, completing the authentication.

Summary

QR code login works by first telling the system who the user is and then proving the identity through a token‑based mechanism tied to QR‑code state changes. The process involves QR‑code generation, scanning, temporary token exchange, and final token issuance, enabling secure cross‑device authentication.