For ticketing

Sell tickets. Scan at the gate. Sleep at night.

Multi-tier ticket sales with HMAC-signed QR codes, a PWA gate scanner that works offline, USSD ticket purchase for buyers without internet, and a transfer and refund flow with a complete audit trail. The ticket someone screenshotted cannot get through your gate twice.

Start selling See pricing

The gate problem

A QR sticker printed at home is not a ticket.

Everyone who has run a serious event in Accra or Kumasi has this story.

You sold tickets through a mobile money number. Buyers paid, you sent a QR or a confirmation message, and on the night your gate was a volunteer with a laptop and a printed guest list. At some point the list got out of sync with the buyers — you had names that were not there, buyers whose names you could not find. Some people walked in because they “already paid,” and you did not want to start an argument, so you just waved them through.

After the event you did the math and realised you sold 380 tickets but admitted 432. The extras were either people who slipped past the volunteer, or people whose QR got screenshotted and forwarded in a group chat. You had no way to tell which — there was no gate log.

voteMe's ticketing was designed with that specific problem in mind. Every QR is cryptographically signed, every scan is logged, and the scanner runs on any staff phone as a PWA. USSD ticket purchase means buyers without smartphones or internet can still buy and receive a 6-digit code to use at the gate. The workflows you need after the sale — transfers, refunds, attendee lists — are first-class dashboard tabs.

Signed QR

Every QR carries a HMAC the gate can verify in one trip.

The QR on a voteMe ticket is a base64url-encoded payload containing the ticket ID, event ID, signing version, a hash of the holder email, and the issue timestamp — concatenated with an HMAC-SHA256 signature. The scanner verifies the signature locally before it ever hits the server.

The signing key lives in a single environment variable paired with a version counter. To rotate — for example, because a staff device was compromised — bump the version on the event's ticketing settings. Newly-issued tickets sign with the new key. Existing tickets remain valid because the validator checks every known version until a match or rejection.

Because signature verification is cryptographic, a QR that someone photographed off your phone cannot be used to walk through the gate a second time. The same ticket flips to used on the first successful scan, and every subsequent scan returns already_used with the scanner ID, gate number, and timestamp. You know exactly who walked in when.

Scanner

A PWA that installs on any staff phone in 30 seconds.

No app-store download, no iOS TestFlight dance. Gate staff open a URL in their phone's browser, tap Install, and the scanner lives on their home screen like a native app. Fullscreen, camera-first, haptic and sound feedback on every scan.

The scan flow: camera detects QR, client parses payload, server validates signature and status, response returns in under 200ms under normal conditions. The result is a full-screen banner — green for valid, amber for already-used or wrong event, red for invalid. Holder name, tier, and seat (when relevant) display for walk-up disputes.

When venue Wi-Fi drops, the scanner falls back to its IndexedDB cache of issued-ticket metadata. Scans made offline are queued with a tentative valid verdict and reconcile automatically when the device comes back online. The audit rows are written once the queue flushes. Unresolvable offline scans are flagged amber and the manual 6-digit short-code fallback lets staff proceed on the spot.

Scanner demo

Every result code your gate team will encounter.

Click a scenario to see what the scanner shows. Toggle offline mode to simulate the IndexedDB queue.

Scan result scenarios

voteMe Gate ScannerOnline

ADMIT

Signature checks out. Status is issued. Gate opens.

Holder

Abena Mensah

Tier

VIP

Time

8:42 PM

First scan — status transitions to used in a Firestore transaction.

USSD ticket purchase

Buyers without internet can still get in.

Ticketing events on voteMe get a USSD channel automatically. Buyers dial the event short code, select a tier, pick a quantity, and pay from MoMo. No smartphone, no data bundle, no app install.

The USSD ticket flow finishes in five screens or fewer. After MoMo confirmation, the buyer receives a 6-digit short code by SMS and email. At the gate, staff enter the short code manually — the system verifies it and marks the ticket as used exactly as it would for a QR scan. Platform takes 5% on ticket revenue; you keep 95%. Paystack processing fees come out of the platform share.

Transfers and refunds

A ticket is a contract — with a clean undo.

Transfers and refunds are legitimate actions that most ticketing tools treat as edge cases. voteMe treats them as first-class flows with full audit trails and automatic QR invalidation.

When a holder transfers a ticket, the original buyer stays on record but the holder identity becomes the recipient. Both parties get a receipt email. You can cap transfers per ticket — the default is one transfer per ticket — so reseller chains cannot use your ticketing as a black market. Every transfer writes a TicketTransfer document with from/to identities and timestamps.

Refunds use a window and percentage you set in ticketing settings — “80% refund if requested more than 24 hours before the event starts,” for example. Buyers request from /my-tickets, you approve from the Tickets tab, the Paystack refund fires, and the QR invalidates the instant the status flips to refunded. Platform fees on refunded tickets are reversed against future settlements.

Audit

Every scan, every transfer, every refund — logged immutably.

The ticketScans subcollection is immutable. Every scan attempt — successful, duplicate, invalid, or fraudulent — writes a row with the scanner identity, timestamp, device info, and result code.

After the event you get an attendance curve, a result-code distribution (valid / already_used / invalid / wrong_event / not_started / ended / refunded), and scanner-by-scanner throughput. Unresolved bad scans raise a SystemNotification at configurable thresholds so a problem at gate 3 does not stay invisible until the post-mortem.

If an attendee claims they bought a ticket and the system rejected them, you have a signed log of the exact code scanned, when, by whom, and why it was rejected. That is the difference between an argument at the gate and a conversation that ends in a minute with both parties satisfied.

Capabilities

The specifics your gate team will ask about.

Six features that make a real difference on event day.

Multi-tier from day one

VIP, Regular, Early Bird — each with its own price, quantity cap, perks list, and optional sales window. No add-ons or upsells required.

HMAC-signed QR codes

Every ticket carries a HMAC-signed payload. The key is rotatable so a compromised signing set can be invalidated without re-issuing sold tickets.

Offline-capable scanner

Your gate device caches issued-ticket metadata in IndexedDB. If venue Wi-Fi drops, scans queue locally and reconcile automatically when the network returns.

6-digit fallback codes

If the camera fails or a phone screen is too cracked to read the QR, staff enter a 6-digit short code by hand. Signature verification still runs server-side.

Transfers, with audit

Allow holders to send tickets to someone else. The original buyer stays on record; both parties get a transfer receipt email. Cap transfers per ticket to one.

Organiser-defined refunds

You set the refund window (e.g. 24 hours before gate) and the refund percentage. Refund requests route into a queue; the QR invalidates on approval.

What makes the gate trustworthy

Paystack-securedSplit payments, no card data ever touches us.
HMAC-signed ticketsRotatable keys so a leaked code cannot be reused.
USSD for every voterReach voters without internet via USSD code *920*221#
No hard deletesEvery action is logged. Nothing vanishes quietly.

“We had three gates for our 1,200-person ceremony. Total scan-to-entry time averaged four seconds. The one gate that went offline mid-rush — a Wi-Fi router died — kept scanning locally and synced every entry when it came back. At the end of the night I had an audit trail I could actually show the board.”

Nana OwusuOperations Director · Volta Regional Awards

Start selling

Your next ticketed event, locked down by default.

Create the event, add tiers, publish, and start selling. Your first gate scanner works from any phone browser — no app store, no installs, no setup.

Start selling See pricing