Connect a webhook (Zapier, Make, n8n or Canvas)

Your QR codes can send real-time events to your favorite automation tool. When someone scans a QR or submits one of your forms, QRCodeKIT sends the event to a webhook URL that you control — so you can add leads to a CRM, post to Slack, log to a spreadsheet, and more.

The flow is always the same:

Get a webhook URL from your tool (Zapier, Make, n8n, or your own endpoint).
Paste it into the QR builder and pick which events to send.
Test it with a real scan or form submission.

Using Zapier? There's an easier wayYou don't need a URL for Zapier. Search for the “QRCodeKIT” app inside Zapier, pick a trigger (New Scan, New Lead, or New Payment) and connect your account — the events flow automatically, with no URL to copy. Use the manual steps below only for Make, n8n, a custom endpoint, or a manual Zapier Catch Hook.

Step 1 — Get your webhook URL

Zapier (manual / Catch Hook)

Create a new Zap and choose Webhooks by Zapier as the trigger.
Pick the event Catch Hook and continue.
Zapier shows a Custom Webhook URL like https://hooks.zapier.com/hooks/catch/1234567/abcde/. Copy it.

Make

Create a scenario and add a Webhooks → Custom webhook module.
Click Add, give it a name, and Make generates an address like https://hook.eu2.make.com/xxxxxxxxxxxxxxxx. Copy it.

n8n

Add a Webhook node as the trigger of your workflow.
Set the HTTP Method to POST.
Copy the node's Production URL (use the Test URL while building). It looks like https://your-n8n-host/webhook/xxxxxxxx.

Your own endpoint

Any HTTPS URL that accepts a POST with a JSON body works. See Payload & security below to verify requests come from us.

The URL must be HTTPS. Plain http:// URLs are rejected.

Step 2 — Paste it into the QR builder

Open (or create) your QR and go to the Content step.
Scroll to Integrations & automations → Destination URL (webhook).
Paste your webhook URL.
Tick the events you want to receive:

QR scanned — fires every time the QR is served on a scan.
Form submitted — fires when a lead/form QR is submitted (only on form-type QRs).

Click + Add webhook and save your QR.

That's it — the webhook is now attached to this QR.

Step 3 — Test it

Turn your Zap / scenario / workflow on (so it's listening).
Scan the QR (open its short URL) or submit the form.
The event should arrive in your tool within a few seconds.

If nothing arrives: make sure the automation is turned on, the URL is pasted exactly, and the QR is active (not paused or archived).

Payload & security

Each delivery is an HTTPS POST with a JSON body and these headers:

Header	Meaning
`X-QRK-Event`	the event type (e.g. `qr.scanned`)
`X-QRK-Delivery`	a unique id for this delivery (use it to de-duplicate)
`X-QRK-Signature`	`t=<timestamp>,v1=<hmac>` — an HMAC-SHA256 signature

Verify a request is really from us: compute HMAC-SHA256 over the string "<timestamp>.<raw request body>" using your endpoint's signing secret (shown when you add the webhook, format whsec_…) and compare it with v1. Reject requests whose t is too old.

Example payloads

qr.scanned — sent for every served scan:

JSON

{
  "id": "b7f3…",
  "event": "qr.scanned",
  "scanned_at": "2026-07-07T10:00:00+00:00",
  "first_scan": true,
  "qr":      { "uuid": "…", "title": "My QR" },
  "project": { "uuid": "…", "name": "Campaign" },
  "account": { "uuid": "…" }
}

form.submitted — the submitted field values travel in the payload:

JSON

{
  "id": "e1a2…",
  "event": "form.submitted",
  "submitted_at": "2026-07-07T10:00:00+00:00",
  "qr":      { "uuid": "…", "title": "Contact form" },
  "account": { "uuid": "…" },
  "fields":  { "Email": "jane@example.com", "Name": "Jane Doe" },
  "answers": [
    { "label": "Email", "value": "jane@example.com" },
    { "label": "Name",  "value": "Jane Doe" }
  ]
}

Reliability

Delivery is near real-time (usually within seconds).
Retries: if your endpoint is down or slow (10s timeout), we retry automatically — 1 attempt plus 3 retries with backoff (5s → 10s → 20s, ~35s total).
Auto-disable: after 10 consecutive failures the webhook is disabled; re-add it once your endpoint is healthy again.
De-duplication: a retried delivery repeats the same X-QRK-Delivery id and payload id — de-duplicate on those.