Temporary identity.
When you need it.

What it actually is

An OTQR is a temporary authorization over one resource. It is not a second kind of identity and it does not replace the asset's own: the identity persists, and the OTQR is a narrow, expiring permission to do one thing with it. Issue one to hand a courier access to a single locker, to let a technician into one machine for an afternoon, or to open a door once.

1. 1 Issued The owner mints it against one named resource. Deny-by-default: the platform checks the issuer is authorized for that resource before anything is created.
2. 2 Presented The holder scans or sends the token. It carries no personal data — it is a permission, not a profile.
3. 3 Spent once Single-use by default. The spend is claimed atomically, so two simultaneous presentations cannot both succeed.
4. 4 Ended Revoked by the owner at any time, or closed by expiry. Either way it is unusable afterwards — and the record of the use stays.

The rules it is built on

Single-use

By default, one presentation. A grant may be raised to a fixed number of uses, and the platform stores that number only when it adds information.

Time-bound

Sixty minutes by default. A grant is never open-ended; it is issued into a window and dies at the end of it.

Scoped

One resource, one purpose. It cannot be widened after issue, and it confers nothing on any other asset.

Revocable

The owner may end it at any time. Revocation is immediate and recorded, with the reason kept against the grant.

Not an identity

It authorizes; it does not identify. It can never become a lasting credential for the thing it opens.

Who, recorded separately

The user of a grant is captured as its own record — human or machine. An entity and a person are never collapsed into one row.

Five honest endings

Revoked, expired, already used, not yet valid, invalid. Five distinct states, because "it failed" tells a caller nothing it can act on.

Offline, bounded

Its sibling credential works offline — but only inside a maximum window, and never for sensitive scopes. Payments, payouts, security and admin scopes are online-required. On reconnection the platform re-checks revocation first, then policy, then expiry; the server stays authoritative.

Where it is used

Anywhere access has to be real but has to stop. A one-off delivery into a locked container. A contractor on site for one shift. A demo unit handed to a prospective buyer. A field device that must keep working through a dead spot and prove itself when it comes back.

OTQR is an API capability today — there is no screen for it yet. A GrowLeafy account can issue, spend and revoke temporary authorizations through the platform API; a point-and-click interface is not built. The link below opens the documentation rather than a page that would pretend otherwise.