The Poster on the Wall Does Not Expire
A site can show a code that changes every thirty seconds, and it can also print one that never changes at all. Both are accepted. They are for different situations, they come from the same secret, and knowing which one is on your wall matters.
The screen at the door refreshes its code twice a minute. The laminated sheet beside it has said the same thing since March. Both will let somebody clock in.
A site code is one of the factors an attendance clock-in can be asked for. It proves the person is close enough to the door to read something on it — which is a different claim from the one a location reading makes, and that is exactly why both exist.
The rotating code
A site can run a kiosk screen: a page opened on a tablet or a monitor at the entrance, showing a code that regenerates every thirty seconds. The code is derived from the current thirty-second interval and the site's secret, so it is unguessable and it is different every time.
When somebody scans it, the code is accepted for its own interval and for one interval either side. That tolerance is deliberate — a clock that only accepted the current instant would refuse anyone whose scan took a second too long, or whose phone clock is slightly out. In practice a scanned code stays valid for somewhere between sixty and ninety seconds, and then it is gone.
What the rotation actually stops
One thing, and it is the common thing: a photograph. A colleague who takes a picture of the screen and sends it to somebody on their way in has a code that will be dead before the message is read. That is the entire threat model of the rotating code, and it handles it completely.
The printed code
Beside the kiosk sits a second option: a print-ready poster carrying a code for the same site, generated once and valid indefinitely. It exists because plenty of sites have no screen and no power for one — a store room, a gate, a remote depot, a client's premises — and a laminated sheet on a notice board is the only practical way to put a code there at all.
The two are separate codes with different shapes, and the verification accepts either. The printed one does not expire, cannot be rotated on a schedule, and can be photographed once and used forever by anyone who has the picture.
A poster is a code you have decided not to rotate. Decide it on purpose.
They share one secret, and that is the useful part
Both codes are derived from a single secret held against the site. Regenerating that secret invalidates the rotating code and the printed one at the same moment. So the answer to "somebody photographed our poster" is one action on the site record — and the consequence is that every poster for that site has to be reprinted, which is the correct amount of friction for an action with that meaning.
A second, independent value controls the kiosk page itself: the address the screen is opened at. Regenerating that changes the kiosk URL without touching either code, which is what you want when a browser tab has been left open on the wrong device rather than when a code has leaked.
| Situation | What to regenerate | What it costs |
|---|---|---|
| A poster was photographed and shared | The site secret | Every poster for that site is reprinted, and the kiosk starts issuing new codes. |
| A kiosk tab was left open somewhere it should not be | The kiosk address | The screen at the door is reopened at a new URL. Codes are unaffected. |
| An employee left with a photo of the wall | The site secret | The same reprint. This is the case the printed code trades away by design. |
| Routine hygiene, nothing has happened | Neither, on a schedule you can keep | A rotation nobody remembers to complete leaves half your sites on the old code and no record of which half. |
Where the code sits in the sequence
A site code is never the whole check, and it is not even the first one. The device has to prove itself first. Then, if the employee is assigned to sites at all, the location has to put them inside one. Only then is the code asked for, and only at sites where somebody has turned it on — it is off by default, per site.
That ordering has a consequence worth knowing: a code cannot rescue a failed location check. Scanning a valid code while the location reading says you are four hundred metres away does not let the punch through. What it does do is change the message and the record — the system reports that the device's location signal looks unreliable rather than blaming the employee's position, and the attempt is stored with the code marked as verified so that whoever reviews it can see what actually happened.
Making a printed code less permanent
The mechanism is one secret and two derivations, so the work here is about lifecycle rather than cryptography — knowing which posters are live, and retiring them on a schedule.
An expiry date on a printed code
A poster valid until a stated date, with the date printed on it, so a sheet on a wall carries its own review deadline.
A poster register
Which sites have a printed code in circulation, when it was issued and when it was last reissued, so a rotation can be completed rather than started.
A rotation reminder
A prompt on a cadence you set, on the same footing as every other scheduled reminder in the product.
We publish scope, not dates.
Scope site codesFour questions to ask about a site code
How long is a scanned code valid?
A good answer sounds like
A number of seconds.
What ours actually is
A rotating code is valid for its own thirty-second interval and one either side — sixty to ninety seconds. A printed code is valid until the site secret is regenerated.
Can a code alone let somebody clock in?
A good answer sounds like
No.
What ours actually is
No. The device check runs first, the location check runs second, and the code is the third question at sites that ask it.
What happens if a code leaks?
A good answer sounds like
One action, with a named consequence.
What ours actually is
Regenerate the site secret. Both codes for that site change together and every printed poster has to be reissued.
Is the secret visible anywhere?
A good answer sounds like
No, including in exports.
What ours actually is
The site secret and the kiosk address are both excluded from serialisation, so they do not appear in interface responses or exports.
Our take
The rotating code and the printed one are not a strong option and a weak option — they are a code for a site with a screen and a code for a site without one, and pretending otherwise would mean either refusing to serve half of the sites that need this or shipping a laminated sheet while implying it rotates. What matters is that the difference is stated, and that the difference is one action to reverse. If you are running printed codes, treat them the way you treat a door key: know how many are out, know who could have photographed one, and have a date in the diary for changing the lock. The system will change it in a second; remembering to is the part that belongs to you.
What AWRA OpsHub does today
- A rotating site code regenerated every thirty seconds from the site's own secret, accepted for its own interval and one either side so a slow scan or a slightly wrong phone clock does not cost a punch.
- A kiosk page for displaying that code, addressed by a long random value separate from the secret, so the screen's address can be changed without changing any code.
- A print-ready poster carrying a non-expiring code for the same site, for locations with no screen.
- Both codes derived from one secret, so a single regeneration invalidates the printed and the rotating code together.
- The site secret and the kiosk address excluded from serialisation, so neither appears in interface responses or exports.
- A per-site switch for whether a code is required at all, off by default, evaluated after the device and location checks rather than instead of them.
- An honest failure message when a valid code is scanned but the location reading disagrees, naming the device's signal as the likely problem and recording the attempt with the code marked verified.
More we can add to your workspace
- An expiry date on a printed code, so a poster carries the date it stops working and a wall states its own review deadline.
- A register of printed codes in circulation — which sites have one, when it was issued, when it was last reissued.
- A scheduled rotation reminder for site secrets, on the same footing as the other reminders in the product.
- A one-time code for a visitor or contractor, valid for a single shift at a single site.
- A record of which specific poster was scanned where a site has several in different doorways.
- A short-lived code for a site with no screen and no printer, delivered to a supervisor's phone for the length of a shift.
Where we point you to a specialist
- We will not present a printed code as equivalent to a rotating one. It is a deliberate trade for sites without a screen, the difference is that it can be photographed and reused, and describing it any other way would sell an organisation a control it does not have.
- A site code is evidence of proximity to a piece of paper or a screen, and we will keep treating it as one factor rather than as proof of attendance. Where an organisation needs stronger presence evidence than location plus a device plus a code, that is a conversation about the site rather than about the software.
- What an employer may require staff to scan, carry or install is an employment matter where you operate, and your advisers settle it. We will configure whichever combination of factors you are entitled to use.
The expiry date and the poster register are the contained pair here, and together they turn a printed code from a permanent object into a managed one.
Find out which code your sites are running
Most organisations with more than a handful of sites are running both and have never had cause to notice. It is a five-minute audit and it usually ends with one poster being reissued.
Talk through site setupFrequently asked questions
Why accept a printed code at all if it never expires?
Because a great many sites have no screen, no reliable power and no appetite for either — a gate, a store room, a client's premises, a remote depot. The alternative to a printed code at those sites is no code at all, which is weaker rather than stronger. The trade is stated rather than hidden, and it is reversed with one action when it stops being acceptable.
How do I stop using printed codes?
Stop issuing posters and regenerate the site secret, which invalidates every printed sheet for that site at once. From then on the only accepted code for that site is the rotating one on the kiosk screen. Nothing else needs changing, because the two codes were always derived from the same secret.
Does regenerating the secret interrupt the kiosk?
Only for the length of one interval. The kiosk asks for a fresh code every thirty seconds and will pick up the new secret on its next refresh. What it does break, permanently, is every printed poster derived from the old secret — which is the intended effect.
Can somebody clock in from home with a photographed code?
Not while the site has a geofence and the employee is assigned to it, because the location check runs before the code is asked for. A photographed code plus a location four hundred metres away is refused. Where a site has no coordinates and the code is the only factor beyond the device, then yes — which is the case for treating printed codes as a managed object with a rotation date.
Is the code required at every site?
No. Requiring a code is a per-site setting and it ships off. Turning it on at a site where staff routinely arrive before anyone has opened the door is a good way to generate corrections rather than attendance, so it is worth enabling where the door is genuinely the entry point and leaving off elsewhere.
What if an employee scans the right code but their phone reports the wrong place?
The clock-in is still refused, and the message says so honestly — it reports that the device's location signal looks unreliable rather than telling the employee they are somewhere they are not. The attempt is recorded with the code marked as verified and the distance the device claimed, so whoever reviews it can tell a bad GPS fix from somebody in the wrong town.
