How QR table ordering works

The six seconds after a scan

The customer points a phone camera at the sticker on their table and taps the link. Their browser opens the café’s menu. That is the entire customer-facing mechanism — the phone’s built-in camera and a web page.

Behind that link, the server does three things. It resolves which café and which table the sticker belongs to. It checks whether that café is currently taking orders. Then it issues the phone a short-lived session of its own, which is what actually authorises the ordering that follows.

The QR code is an address, not a password

This distinction matters more than it sounds. A sticker on a table is public by definition: it can be photographed, copied, reprinted and shared, and you cannot take it back once it is on the table. So it is treated as an address — it says which table this is and nothing more. It never grants anybody anything on its own.

Authorisation comes from the session the server mints at scan time, not from the URL. A copied link gets its own session and can see only what that session ordered. It cannot read the orders of the people actually sitting at the table, and it cannot change them.

If a code is ever misused, the café can rotate that table’s code from the owner portal. The old sticker stops resolving; a new one prints.

A table is furniture. A session is the party sitting at it.

Orders belong to a dining session, never directly to a table. Table 7 exists all day; the four people at table 7 between one and two o’clock are a session. When they leave and staff close the session, the next party starts a clean one at the same table.

One session can hold several separate orders — a first round, then dessert forty minutes later — and each keeps its own history. There is no shared cart to fight over and no way for one customer’s order to silently appear on somebody else’s.

Nothing is committed until a human accepts it

A placed order arrives on the staff board as new. It is a request at that point and nothing more. A member of staff accepts it, and that tap is the moment an anonymous request from a phone becomes committed work in your kitchen.

Keeping a person at that gate is deliberate. It is what stops a prank scan from putting food on the pass, and it is the control a café already understands, because it is the same judgement a waiter makes when somebody orders out loud.

Rejecting a new order costs nothing and any kitchen staff member can do it instantly. Cancelling an order that was already accepted destroys committed work and has meaning at the till, so it needs a waiter, manager or owner — and it is recorded.

What we never ask the customer for

No name, no phone number, no email, no address, no account, no app. The ordering flow is designed to work without knowing who the customer is, and it does.

That is a deliberate cap on how bad a breach could ever be, not an oversight to be improved later: there is no customer contact database to leak because one is never collected. Prices, availability and totals are decided by the server from the café’s own menu, so a phone that lies about any of them gets the café’s real price or an error.