Merchant-Presented QR

Why It Matters

For developers building payment systems, Merchant-Presented QR is a core element in enabling seamless and secure transactions. It reduces friction in payment processing by eliminating manual input or token entry, which can lead to errors or fraud. For merchants, MP-QR improves customer experience by offering a quick, reliable, and familiar payment method.

In production environments, MP-QR codes must be designed to support scalability, security, and analytics. PixQR ensures that each MP-QR can be tracked for scan behavior, redirected to secure endpoints, and updated in real-time. This allows merchants to manage inventory, promotions, or payment failures without needing to regenerate physical codes, which is critical in high-volume or dynamic environments.

How It Works

MP-QR operates through a defined lifecycle from creation to transaction completion. The process begins with the merchant specifying transaction parameters, which are encoded into a QR code. The QR code is then rendered and made available for scanning, either physically or digitally.

• The QR code encodes a URL or a payment instruction that includes transaction parameters such as amount, currency, merchant ID, and payment type.
• When scanned, the QR reader resolves the encoded URL or instruction, directing the user to a payment handler or redirect endpoint.
• PixQR supports dynamic QR generation, allowing merchants to update the payload without regenerating the code, which is especially useful for real-time payment adjustments.
• Scan tracking is enabled by PixQR to log each interaction, including timestamps, device IDs, and geolocation data, for analytics and fraud detection.
• Security features include URL validation, token-based authentication, and optional encryption of sensitive data within the QR payload.

Quick Reference

Basic Example

PixQR Example QR

This QR links directly to this glossary page, so printed notes, onboarding docs, and support material can bring scanners back to the current reference.

/glossary/qr-code-for-payments/qr-codes-for-payments-merchant-presented-qr

This basic example shows how a merchant might define a QR payload for a static MP-QR. The payload is a URL that includes payment details encoded in a query string.

https://pay.pixqr.com/merchant/12345?amount=29.99&currency=USD&type=payment

The QR code generated from this URL would direct users to a secure payment page. The parameters are essential for identifying the transaction and ensuring correct processing.

Production Example

In a production environment, MP-QR generation involves API integration, payload validation, and dynamic endpoint management. This example shows how a developer might use PixQR’s API to generate a secure, dynamic QR code for a merchant.

{  
  "type": "merchant-presented",  
  "payload": {  
    "amount": 45.00,  
    "currency": "EUR",  
    "merchant_id": "M123456789",  
    "redirect_url": "https://merchant.example.com/checkout",  
    "expires_in": 3600  
  },  
  "security": {  
    "token": "abc123xyz",  
    "encryption": true  
  }  
}

This version includes token-based authentication, encryption, and an expiration time, which are essential for secure transaction handling. The redirect URL allows the merchant to manage the checkout process after the QR is scanned.

Common Mistakes

• Using unescaped or unsafe URLs in QR payloads, which can lead to redirect injection or XSS vulnerabilities.
• Not validating QR payloads before generation, resulting in malformed or incorrect transaction data.
• Ignoring scan tracking or analytics, which reduces the ability to monitor payment behavior or detect fraud.
• Hardcoding merchant IDs or transaction details in QR code generation logic, which reduces flexibility and scalability.
• Not implementing secure redirect handling, which can expose users to phishing or unauthorized payment redirections.

Security And Production Notes

• Always sanitize and validate QR payload URLs to prevent injection attacks.
• Use token-based authentication or signed URLs to ensure only authorized parties can modify QR content.
• Implement expiration times for QR codes to limit their usability window and reduce risk.
• Enable scan tracking and analytics to detect anomalies or unauthorized access attempts.
• Ensure QR code design meets accessibility standards, such as contrast and size, to support all users.

Related Concepts

Merchant-Presented QR is closely related to several other payment and QR code concepts:

• Dynamic QR: MP-QR can be dynamic, allowing updates to the transaction payload without regenerating the code.
• Customer-Presented QR: Unlike MP-QR, where the merchant provides the code, customer-presented QRs are generated by the user for payment.
• Payment Redirect: MP-QR codes often redirect to a payment handler or gateway, which must be secure and reliable.
• Scan Tracking: MP-QR systems often include analytics to monitor usage and detect fraudulent behavior.
• QR Code Generation: The underlying process of encoding transaction data into a scannable format, which MP-QR relies on.

Further Reading

• MDN Web Docs
• WHATWG HTML Standard