QR code auth: The WhatsApp Web pattern for TAMSIV
To connect the website to the mobile app, I wanted something instant. The WhatsApp Web pattern: scan a QR code and boom, connected.
The flow
The user opens tamsiv.com → QR code appears → scans with the app → the site connects instantly. From a technical perspective: a ballet of tokens and real-time channels.
The architecture
The QR code encodes a session UUID. The site creates a Supabase entry with "pending" status and subscribes via Realtime. The mobile app scans, confirms with its existing JWT. The backend generates an auth token for the web.
Fallback polling
If Realtime doesn't connect in 3 seconds, it switches to HTTP polling every 2 seconds. Works everywhere, even behind corporate proxies.
Security
- QR code expires after 5 minutes
- Single-use — a session can only be confirmed once
- Auth required on mobile
- Ephemeral token to initiate the web session
The UX
QR auto-regeneration every 4min30 with a visual countdown. Email/password and Magic Link options as backup. ~300 lines on the web side, 150 on the mobile side. The kind of feature that makes you say "that's well thought out".