Scan Code Pro API Documentation

Base URL: https://api.scancodepro.com

All endpoints below require an API key in Authorization: Bearer <api_key> and an active Business or Enterprise subscription. View plans and pricing to get access. Create and manage keys in the signed-in dashboard. Keep keys on your server or in a secret manager; never include them in query strings, public browser code, or image URLs. These generation endpoints do not create saved codes or scan analytics.

For saved-code management, campaign ZIPs, scan summaries and print checks, see the MCP integration guide.

Endpoints

Endpoint	Success response
GET /api/v1/code	PNG image; SVG supported for QR only
GET /api/v1/wifi	PNG or SVG WiFi QR image
POST /api/ai/qr	JSON containing a PNG data URL or SVG text
GET /api/ai/qr	Same JSON response, using query parameters

Use POST for WiFi credentials so they are not placed in URLs. Responses have Cache-Control: private, no-store. Treat generated WiFi codes and other sensitive output as credentials; do not put them in public caches.

Image generation parameters

GET /api/v1/code accepts:

Parameter	Values and behavior
type	qr (default), code128, ean13, upca, pdf417, datamatrix, aztec
data	Required nonblank content; barcode data must satisfy its symbology
format	png (default) or svg; SVG is supported only for qr
size	Integer 64–2048, default 256; QR width, scale input for other types
margin	Integer 0–64, default 4; QR quiet zone in modules, barcode padding before scaling
fg, bg	Three or six hexadecimal digits, optional leading #; defaults 000000 and FFFFFF
ec	L, M (default), Q, H; accepted only for QR
label	Optional nonblank replacement display text for code128, ean13, upca
labelPos	top, bottom (default), none; only for those 1D types; cannot combine none with label

Unknown enum values, fractional numbers, out-of-range numbers, and invalid colors return 400. PDF export is not supported by these endpoints.

GET /api/v1/wifi accepts the same format, size, margin, fg, bg, and ec settings, plus:

Parameter	Values and behavior
ssid	Required nonblank network name
security	WPA (default), WEP, or nopass
password	Required and nonblank for WPA/WEP; omitted or ignored for nopass
hidden	Literal true or false in query parameters; default false

WiFi field delimiters are escaped before encoding.

JSON QR generation

POST /api/ai/qr accepts a JSON object with type: "url" or type: "wifi".

• For url, provide an absolute HTTP or HTTPS url.
• For wifi, provide the WiFi fields above. JSON hidden must be an actual boolean, not a string.
• format is png or svg, default png.
• size is an integer from 64 to 2048, default 256. JSON numeric settings must be numbers, not strings.
• margin, fg, bg, and ec are also supported, with the ranges above; the JSON helper's margin defaults to 2.

GET /api/ai/qr uses the same fields as query parameters. Both methods return:

{
  "success": true,
  "data": "data:image/png;base64,...",
  "metadata": { "type": "url", "format": "png", "size": 256 }
}

For SVG, data contains SVG XML rather than a data URL. The image endpoints return raw image bytes instead of this JSON structure.

Examples

These commands assume SCANCODEPRO_API_KEY is supplied securely through your environment. They are server-side examples; do not publish your key.

QR SVG:

curl --fail-with-body --get 'https://api.scancodepro.com/api/v1/code' \
  -H "Authorization: Bearer $SCANCODEPRO_API_KEY" \
  --data-urlencode 'type=qr' \
  --data-urlencode 'data=https://example.com' \
  --data-urlencode 'format=svg' \
  --output qr.svg

Code 128 PNG with a display label:

curl --fail-with-body --get 'https://api.scancodepro.com/api/v1/code' \
  -H "Authorization: Bearer $SCANCODEPRO_API_KEY" \
  --data-urlencode 'type=code128' \
  --data-urlencode 'data=INV-0001' \
  --data-urlencode 'label=Invoice 0001' \
  --data-urlencode 'labelPos=bottom' \
  --output code128.png

WiFi JSON via POST. The values below are illustrative; keep a real request file private.

curl --fail-with-body 'https://api.scancodepro.com/api/ai/qr' \
  -H "Authorization: Bearer $SCANCODEPRO_API_KEY" \
  -H 'Content-Type: application/json' \
  --data-binary @- <<'JSON'
{
  "type": "wifi",
  "ssid": "Guest Network",
  "password": "example-password",
  "security": "WPA",
  "hidden": false,
  "format": "png",
  "size": 256
}
JSON

Usage and errors

Business includes 1,000 authorized requests per UTC calendar month, shared across all keys belonging to the account. Enterprise has no monthly request cap. Every request admitted with a valid key and active paid subscription counts before generation validation, including malformed input or a later generation failure. Missing/invalid keys and inactive subscriptions are rejected without consuming usage.

A separate in-memory abuse limiter allows 60 requests per minute per IP per endpoint family. AI GET and POST share one bucket. This limiter is per running instance, not a distributed quota or a paid-plan allowance; an admitted request that hits it still consumes monthly usage.

Status	Meaning	Body
200	Generated output	Image bytes or the JSON success structure above
400	Invalid input or generation failure	Plain text for image endpoints; {"success":false,"error":"..."} for AI JSON
401	Missing, invalid or revoked API key	{"error":"..."}; WWW-Authenticate: Bearer challenge
403	Active Business/Enterprise subscription required	{"error":"..."}
429	Monthly quota exhausted or instance abuse limit reached	Monthly denial: {"error":"..."}; instance denial: plain text for images, AI error JSON for AI
503	Authorization infrastructure unavailable	{"error":"..."}; access fails closed

Authorized responses include monthly quota headers, including validation failures:

• X-RateLimit-Used: admitted requests this month.
• X-RateLimit-Limit: 1000 for Business or unlimited for Enterprise.
• X-RateLimit-Remaining: Business requests remaining; omitted for Enterprise.
• X-RateLimit-Reset: next UTC month boundary as an ISO timestamp.
• Retry-After: retry delay in seconds on 429, for either limit.

Monthly quota denials also include the quota headers. Other authorization denials do not include usage headers. All API responses are private/no-store. Check the status and content type before interpreting an error as image bytes.

Machine-readable contracts: /openapi.json and /ai-openapi.json.