# QR codes for click and collect

> Click-and-collect QR codes are consumer-presented: the customer shows a code from their phone and the store scans it. Keep the payload a short opaque token, not a long URL, so hardware scanners read it fast off a screen, and always print a human-readable fallback code beside it for when scanning fails.

Source: https://useqr.app/docs/ecommerce/qr-code-for-click-and-collect · Last reviewed 2026-08-21 · UseQR is free forever, MIT licensed, no signup.

---

## The direction is reversed

Most retail QR codes are merchant-presented: printed by the business, scanned by the
customer. Collection codes flip it — the **customer presents** a code from their order
confirmation and the **store scans** it to release the order. That family of patterns is
described in [consumer-presented QR](/docs/payments/emvco-consumer-presented-qr) for
payments, and the same engineering realities apply here:

- The code is displayed **on a phone screen** and read by a hardware scanner or a staff
  device — so [screen-scanning issues](/docs/scanning/scanning-a-qr-code-off-a-monitor)
  (brightness, glare, cracked screens, auto-dimming mid-queue) are the failure modes.
- The scan must be **fast at a service point** — a code that takes three seconds to lock
  is a queue.

Both point at the same design rule: **short payloads**. A collection code should contain
an opaque token — `PU-7F3K9Q2M` or a compact URL wrapping it — not a 300-character signed
JSON blob. A version 2–3 code with large modules locks near-instantly on a scanner;
dense codes on dim screens are where collection flows go wrong. Validation belongs
server-side, keyed by the token.

## The three collection flows

**Counter pickup.** The confirmation email/page shows the QR plus — always — the token in
human-readable text beneath it. Staff scan, or type the eight characters when the screen
is cracked or the scanner is down. Skipping the printed fallback is the most common
implementation mistake in the whole pattern; screens fail at service points daily.

**Lockers.** The locker bank's camera reads the customer's code and pops the door. Two
codes exist here and they must not be confused: the *customer's* collection code, and
often a *merchant-presented* code on the locker bank that opens the pickup web page for
customers who arrive without the app. Label the second one clearly with what it does.

**Kerbside.** The customer parks and scans a *merchant-presented* code on the bay sign,
which opens a check-in page — order number prefilled from the URL if they tapped through
from the confirmation, otherwise a short form plus bay number. Staff bring the order out.
Bay-sign codes are outdoor print at car-window distance: **≥ 5 cm**, laminated matt, per
the [outdoor durability rules](/docs/print/qr-codes-outdoors-durability). Generate one
per bay [in bulk](/bulk) with the bay in the URL.

## Practical build notes

- **Tokens are bearer credentials** — anyone with the code collects the order. Expire
  them after collection, scope them to one order, and require ID or the order name for
  high-value goods. Treat screenshots of collection codes like tickets, not like links.
- **Email clients mangle images.** Embed the QR at at least **300 × 300 px**, and repeat
  the text token — dark-mode inversion in some clients can render a code unscannable, and
  the [inverted-code failure](/docs/troubleshooting/qr-code-inverted-and-unreadable)
  applies to email templates too.
- **Offline behaviour**: the confirmation page should cache the code so it renders in a
  concrete-and-steel collection area with no signal.
- Same-day churn means codes can be short-lived — unlike
  [packaging codes](/docs/ecommerce/qr-codes-on-product-packaging), permanence is not the
  constraint; revocability is.

## FAQ

### What should a click-and-collect QR code contain?
A short opaque token identifying the order — not customer data, not a long signed payload. Short payloads make low-density codes that hardware scanners read quickly from phone screens, and the server does the validation.

### Why include a text code under the QR?
Because screens crack, brightness drops, and scanners fail. A human-readable eight-character token beside the code lets staff type it and keeps the queue moving. It is the cheapest resilience in the whole flow.

### How do kerbside pickup QR codes work?
A merchant-presented code on each bay sign opens a check-in page with the bay number in the URL; the customer confirms their order and staff bring it out. Bay signs are outdoor print — 5 cm codes, matt lamination.

### Are collection QR codes secure?
They are bearer tokens: whoever shows the code gets the order. Single-use tokens, expiry after collection and an identity check for high-value orders are the standard mitigations. Never encode personal data in the code itself.

## Try it

- https://useqr.app/url
- https://useqr.app/text
- https://useqr.app/validate