A QR ticket is an electronic pass carrying a unique code that is verified against a database at the door: the system checks whether the ticket is paid for, whether it is valid for this event and whether anyone has already used it. The check takes a fraction of a second: at the UzFranchise Expo it was 0.2 seconds per guest.
Key takeaways
The code itself usually carries a link or an identifier rather than personal details: the system uses it to find a record and checks payment, category and entry history there. That matters in two ways — the code cannot be "read" to reveal someone's phone number, and a ticket cannot be forged by redrawing a picture.
The format itself is resilient: a QR code has four error correction levels, and level M is the one most often chosen — it restores data when roughly 15% of the codewords are damaged. A creased or partly glared ticket on a phone screen is therefore usually still read.
The journey is the same wherever registration happens — on a website, in an app or in a Telegram bot. The channel changes, the logic does not.
Everything that follows — segments, mailings, repeat invitations — works from that record. The full story of one such project, from the bot to the organiser's dashboard, is told in the UzFranchise Expo case study.
A paper list works while there are fewer than a hundred guests and a single entrance. Beyond that come queues, misspelled names and no way to tell who has already come in.
| What happens at the door | Paper list | QR ticket |
|---|---|---|
| Finding a guest | By eye down the rows, slower the longer the list | A scan of the code, with the answer on screen at once |
| Re-entry on someone else's ticket | Noticed only by accident | Visible immediately: the ticket is already marked used |
| Payment status | A separate file, often out of date | Checked at the moment of entry |
| Several entrances | Lists drift apart between points | One database, every point sees the same thing |
| Report after the event | Manual counting of ticks | Ready figures by time, entry point and category |
The mechanics are the same; what differs is what the system checks at the moment of scanning.
A static image protects nothing on its own: it can be forwarded to a chat or photographed off someone else's screen. Protection comes from the check against the database at the moment of entry and from the rules attached to it.
For events with an expensive ticket a dynamic code is added: it changes on the owner's screen every few dozen seconds, so a forwarded screenshot expires before anyone can use it. Such a code works on the same principle as the one-time passwords in authenticator apps: the TOTP standard describes generating a value from a shared secret and the current time, with a default time step of 30 seconds.
Connectivity on site is the weakest point on the day: people arrive at once, the mobile network in the hall is saturated, and guests are standing in front of the scanner. So offline mode is planned in advance rather than improvised on the spot.
Tip Before the event, load the ticket list into the scanning app's own storage. If the connection drops it checks the code against the local copy and queues the entries, then sends them to the server once the network returns and highlights the conflicts — tickets marked as used at two points at once.
Fully offline this scheme does not hold: until the devices have synchronised, a repeat entry at different doors is only visible after the fact. Large venues therefore keep a wired connection on at least one point and a backup channel on a separate operator.
In Uzbekistan Telegram is the shortest route to a guest: registration, the ticket and the reminders all live in one chat, with no separate app to install. How such a bot is assembled and what it can do is covered in our piece on Telegram bot development for business.
Payments come with a rule worth knowing before you start. A ticket to an offline event is a real-world service and is paid for by card through a payment provider — in Uzbekistan that means Payme and CLICK, while Telegram acts as the invoice interface and charges no commission for the Payments API. Access to an online event, however — a webinar, a recording, a private channel — counts as a digital service, and inside Telegram such goods are sold for Telegram Stars only. Payment scenarios and the messages that follow them are set out in the article on payments in a Telegram bot.
The value of a ticketing system does not end at the door: what remains afterwards is a database showing not only who registered but who actually came. Those are two different lists and they deserve different treatment.
How events from a bot turn into deals, and what to do when the exchange fails, is described in our piece on integrating a Telegram bot with a CRM. Personal data deserves separate attention: law No. ZRU-1125 of 26 March 2026 left mandatory storage inside Uzbekistan only for biometric and genetic data and the data of telecom operators' users, and only databases holding those categories are entered in the State Register. Guest contacts are personal data, so consent to process them is collected at the registration step rather than afterwards.
The work starts with a description of who goes where, not with code. Mistakes made here cost the most later: access rules cannot be rewritten on the day of the event.
One detail pays for itself at exhibitions: a scanner for partners. At the UzFranchise Expo the exhibiting companies scanned a guest's QR code with their own phone and the contact went straight into their database — no equipment and no paper forms on the stand.
There is no single price for "a ticketing system": the budget is made up of the registration channel, the number of roles and zones, payments and integrations. The reference point on our service page is a bot that takes enquiries, from $1,200; for events and venues with registration it issues QR tickets and counts who turned up.
We start with a map of entries: who goes where and how many times. Then registration is built in the channel the audience already uses, payments and the CRM are connected, and scanning is tested on real devices and on a poor connection — before the event rather than on opening day. Afterwards the organiser keeps a database with segments, statistics by time and entry point, and ready-made lists for the next invitation.
Let’s discuss your project
Tell us what you need, and we will estimate the timeline and cost and suggest a solution.
For most events a smartphone or tablet with a camera and access to the verification system is enough. Dedicated terminals are used where the flow at the door is very dense, where staff work in gloves or in the cold, or where long battery life without a power socket is required.
That is a setting rather than a property of the code. For a single-entry ticket access is blocked after the first scan. For a season pass, a multi-day exhibition or a club pass you set the number of permitted entries or a window of dates within which the ticket is valid.
The ticket is tied to a database record rather than to an image, so it is simply reissued to the same channel — a chat, an email or an account page. If there is any suspicion that the code reached someone else, the old identifier is cancelled and a new one is generated.
Yes. A ticket to an offline event is paid by card through a payment provider, which in Uzbekistan means Payme and CLICK. Access to an online event counts as a digital service, and inside Telegram such goods are sold for Telegram Stars only.
The system compares two lists: those who registered and those whose ticket was scanned at the door. The gap between them is the no-shows. That segment then gets a mailing of its own — an invitation to the second day of the event, for instance.
Only databases that are legally required to be stored inside Uzbekistan go into the State Register — those holding biometric data, genetic data and telecom subscriber data. Guest contact details and questionnaire answers don't fall into that category. They are still personal data though, so consent to process them is collected right in the registration form, before the ticket is issued.
