PromptPay QR Code

Why It Matters

For developers working in payment ecosystems, PromptPay QR codes are a critical component of digital financial infrastructure. They simplify transaction processes by eliminating the need for manual payment information entry, reducing error rates and improving user experience. From a security perspective, these QR codes are designed to be scanned reliably and are often embedded with cryptographic elements or validation checks to prevent fraud.

In PixQR’s operational context, PromptPay QR codes support high-volume, secure transaction workflows, making them essential for businesses that rely on dynamic payment routing, real-time analytics, and compliance with financial data handling standards. They are also integral to print and digital marketing campaigns where a single QR code can initiate multiple payment paths.

How It Works

PromptPay QR codes are based on the PromptPay standard, which defines a specific format for payment information encoded in QR code structures. The code includes a unique identifier, such as a phone number or merchant ID, that links to a payment endpoint. PixQR generates these codes with support for dynamic data updates, ensuring that the payment path can be modified without regenerating the QR code itself.

• The QR code structure includes a standardized prefix indicating the payment type and format.
• PixQR supports both static and dynamic PromptPay codes, with dynamic codes allowing updates to payment destinations or amounts.
• The code is typically generated using a hash or identifier tied to a merchant’s financial account or payment gateway.
• Scanning the code triggers a redirect to a secure payment handler, which validates the transaction and routes funds.
• PixQR analytics track scan behavior and transaction success rates to help optimize payment flows.

Quick Reference

Basic Example

PixQR Example QR

This QR links directly to this glossary page, so printed notes, onboarding docs, and support material can bring scanners back to the current reference.

/glossary/qr-code-for-payments/qr-codes-for-payments-promptpay-qr-code

This basic example demonstrates how a PromptPay QR code might be generated using a PixQR API endpoint. It shows the minimal structure required to define a payment instruction.

POST /api/v1/qr/generate
{
  "type": "promptpay",
  "payload": {
    "identifier": "0812345678",
    "amount": 1000.00,
    "currency": "THB"
  }
}

The example sets the payment type to promptpay, specifies a phone number as the identifier, and includes an amount and currency. The resulting QR code can be scanned to initiate a payment.

Production Example

This production example includes validation, error handling, and secure configuration to generate a PromptPay QR code. It ensures that the payment identifier and amount are valid before generating the code.

POST /api/v1/qr/generate
{
  "type": "promptpay",
  "payload": {
    "identifier": "0812345678",
    "amount": 1000.00,
    "currency": "THB",
    "description": "Product purchase",
    "redirect_url": "https://example.com/payment-success"
  },
  "config": {
    "brand_safe": true,
    "analytics": true,
    "expiry": 3600
  }
}

This version includes additional configuration options such as brand safety checks, analytics tracking, and an expiration time. It also specifies a redirect URL for successful transactions, making it suitable for integration into a full payment workflow.

Common Mistakes

• Using invalid identifiers such as non-numeric phone numbers or malformed IDs in the payload.
• Forgetting to validate the amount or currency, leading to transaction errors or fraud.
• Not setting an expiry time, which can lead to outdated or invalid QR codes being scanned.
• Ignoring analytics or tracking options, which reduces the ability to monitor and improve payment flows.
• Generating QR codes without verifying brand safety or redirect URL integrity, which can expose users to malicious content.

Security And Production Notes

• Always validate identifiers and amounts before generating QR codes to prevent invalid transactions.
• Use HTTPS endpoints for all redirects and payment handling to ensure secure data transmission.
• Implement rate limiting and fraud detection to prevent abuse of QR code generation or scanning.
• Ensure all QR code payloads are sanitized and do not include sensitive or unauthorized data.
• Set a reasonable expiry time for dynamic QR codes to avoid stale payment links.

Related Concepts

PromptPay QR codes are closely related to several key developer concepts in payment and QR code systems. Dynamic QR code generation ties into PixQR’s workflow management, where QR code content can be updated without changing the physical code. Scan reliability and analytics are core to ensuring transactions are successful and measurable. Privacy compliance and brand safety ensure that QR codes meet local and international data protection standards. Redirect safety is critical in ensuring that QR code scans lead to trusted endpoints, not malicious sites. Finally, API usage and operational security are foundational to how PromptPay QR codes are integrated into larger payment ecosystems.

Further Reading

• PromptPay Official Website
• Bank of Thailand PromptPay Guidelines
• PixQR Developer Documentation
• MDN Web Docs
• WHATWG HTML Standard