What makes an event pass a pass, and not a poster

Email a QR code to four hundred attendees and you have not issued four hundred passes. You have published one image four hundred times and asked people not to share it.

The gap between those two things is single use, and it is a smaller mechanism than it sounds — which is why it is worth saying precisely what it does.

The failure mode

A static QR ticket encodes something: a booking reference, a URL, a signed token. Whatever it encodes, the pattern is the credential, and the pattern is on a screen that screenshots. One attendee forwards it to a friend who could not get a ticket, and two people arrive holding the same valid code. Nothing about the code can tell them apart, because there is nothing to tell apart: they hold identical bytes.

Scanning harder does not fix this. Neither does a prettier badge design.

What single use actually means here

A pass on this platform is a code whose gate is a private link issued to one attendee, carrying a viewer policy of one view per viewer.

The code does not hold the pass. It holds an opaque address; the pass is a record behind it. When the link is consumed, that consumption is written down, and the second attempt resolves the same address to a closed gate rather than to the content. The screenshot still scans — you cannot stop a camera reading a printed square — but what it reaches has stopped saying yes.

Three properties follow, and they are properties of a stateful gate rather than of the pattern:

• Revocation is immediate. A refunded ticket is a row you revoke, and the next scan of that code fails. No reprint, no reissue, no list of blocked serial numbers at the door.
• Expiry is a time, not a hope. The gate closes on its own after the event. Nobody has to remember to decommission anything.
• The pass is attributable. One link per attendee means the record says which link was consumed, not merely that some pass was used.

Where the guarantee ends

Single use is single OPEN, not single ENTRY. The gate counts consumptions of the link, not humans through a door. If your staff scan a phone that has the pass already open on screen, the gate was passed once and the content stays on that screen for as long as the phone is unlocked. A pass shown to a second person at the same door is not something a cryptosystem can see. Single use raises the cost of sharing from zero to "the sharer loses their own entry" — which is usually enough, and is not the same as impossible.

The content is not protected from the attendee. Whatever the pass page says, the person you issued it to can read, screenshot and forward. What they cannot do is give away a working pass while keeping one.

A pass is only as private as its delivery. Send the link through a channel the attendee does not control and you have handed the pass to whoever does control it. This is why access can be delivered to a verified recipient address rather than returned to the caller: the server mints the link and mails it, and an integration never holds a working credential in its own logs.

Metadata is visible to your team. "VIP — J. Smith" in a pass title is readable in the dashboard by anyone with access. The encryption is on the payload, not on the label you gave it.

The honest summary

Single use does not make a pass unforgeable. It makes sharing a pass cost the sharer their own entry, turns a refund into a revocation instead of a reprint, and gives you a record of which pass was used rather than how many were seen. For an event, that is the entire useful difference between a pass and a poster.

Start from the event pass template — one link per attendee, openable once, already configured.