QR Code / Public Token Usage

Overview

Survanta supports public access tokens that can be encoded in links or QR codes. A SingleSurvey token opens one survey at /p/{token}. A TenantActiveSurveys portal token opens a tenant survey list at /portal/{token}.

Guests can submit anonymously. If an eligible tenant user sends a valid JWT while submitting through a public token flow, Survanta attributes the response to that user while retaining its public-token origin. Token or QR origin alone does not force an authenticated submission to be anonymous.

Who Is This For?

• Anonymous respondents — members of the public, customers, or participants who are invited to complete a survey without being registered users of the Survanta platform.
• Authorized tenant users distributing surveys — users with the relevant public-link permission can issue and share links or QR codes.

Public access is not a replacement for tenant-user JWT authentication when tasks, response history, or other protected features are needed.

How QR Code Access Works

1. An authorized user creates a public survey link and may generate a corresponding QR code.
2. The QR code is shared with respondents — for example, printed on a flyer, displayed on a screen, or sent via email or messaging.
3. A respondent scans the QR code using the Survanta app or any standard QR scanner on their device.
4. The scanner opens /p/{token} for a single survey or /portal/{token} for a portal.
5. The respondent fills in the questionnaire and submits their responses.

No account is required for a guest flow. A token may still require its configured passcode and remain subject to start/expiry, revocation, open, submission, and tenant response limits.

How Public Token Access Works

A public token is the text-based equivalent of the QR code. It can be shared as a direct URL or access code:

1. Send POST /api/mobile/public/resolve-token with { "token": "...", "passcode": "optional" }.
2. The server resolves accessType as SingleSurvey or Portal; the client must not probe multiple routes to guess the type.
3. For SingleSurvey, load /p/{token}/runtime and submit to /p/{token}/submit.
4. For Portal, list /portal/{token}/surveys, load /portal/{token}/surveys/{surveyId}/runtime, and submit to /portal/{token}/surveys/{surveyId}/submit.
5. Handle 401 for a required/invalid passcode, 404 for an unknown/wrong-scope token, and 410 for an unavailable token.

Difference Between Public Token Access and Researcher Login

Limitations of Public Access

• Guest responses submitted via QR or public token are anonymous and permanently immutable.
• SingleSurvey grants one-survey access; TenantActiveSurveys grants portal discovery within the owning tenant.
• Single-survey and portal expiry is optional. Tokens can also be not-yet-active, revoked, inactive, exhausted, passcode-protected, or limited by opens/submissions.
• New responses also consume the tenant's response allowance; rejected capacity checks do not create a response.

Security Considerations

• Public tokens should be treated as the survey's access key. Anyone with the token or QR code can respond to the survey.
• If a token is shared more widely than intended, an administrator can deactivate it from the Survanta management console.
• Public requests are tenant-stamped only after token validation. Clients must not expose tokens in logs, analytics, or screenshots.

Scanning a QR Code with the Survanta App

1. Open the Survanta app.
2. From the Home screen or login screen, tap Scan QR Code.
3. Point your device's camera at the QR code.
4. The app recognizes the code and opens the associated survey automatically.
5. Complete and submit the survey.

You do not need to be signed in for a guest response. When signed in, sending the JWT can attribute the public-origin response and may allow later editing only through authenticated response endpoints when every editability rule passes.