---
title: "Render a QR code (stores nothing)"
method: POST
path: "/qrcodes/render"
tags: ["QR Codes"]
---

# Render a QR code (stores nothing)

`POST /qrcodes/render`

## Request

- Base URL: `https://getdynamicqr.com/api/v1`
- URL: `https://getdynamicqr.com/api/v1/qrcodes/render`
- Auth: API key in header `X-Client-ID` and HTTP bearer

Encodes your content into a QR image and returns it in the response
body. **Nothing is stored**: no QR code record is created, no UUID is
minted, no redirect through this domain is involved, no audit entry is
written, and the encoded content is not logged.

Every other endpoint here creates a *dynamic* code, which encodes a
`/q/{uuid}` address on this domain and resolves to your destination on
each scan — that is what lets a printed code be re-pointed later. This
one encodes your address directly, so the scanner never touches us. The
trade is the obvious one: **a code rendered here can never be re-pointed,
and it records no scans.** Print it only when that is what you want.

Send either `data` (the literal payload) or `qr_type` plus `content`
(a type described by its fields). The types that resolve to a page this
application serves — social, app, coupon, menu, barcode, gift_giveaway —
are refused here, because there is no version of them that encodes
nothing of ours.

Four advisory headers ride on the response, because an image body has
nowhere to put them: `X-QR-Scannable` (`yes` or `warnings`),
`X-QR-Warnings`, `X-QR-Contrast-Ratio`, and `X-QR-Frame-Omitted` on a PNG
whose design carries a frame or caption.

**Requires the `api_access` plan feature.** Without it this endpoint answers 403 even with valid credentials.

## Request body

- object
  - `data` string: The literal string to encode, max 2048 characters. Mutually exclusive with qr_type/content.
  - `qr_type` string: One of: url, whatsapp, wifi, email, sms, phone, vcard, text, pdf, video. Default: url.
  - `content` object: The fields belonging to qr_type, using the same names the dashboard uses, e.g. {"wifi_ssid":"Guest","wifi_security":"WPA"}. Also accepted at the top level. An unrecognised key is a 422.
  - `format` string: svg (default) or png.
  - `size` integer: Edge length in pixels. SVG 96-4096 (default 512); PNG 96-512 (default 512). For print, ask for SVG and scale it losslessly.
  - `design_preset` string: A QR Studio look to draw it in. With neither this nor design, the code is drawn as classic_ink.
  - `design` object: QR Studio fields applied over design_preset, or over the studio defaults on their own.
  - `logo` string, binary: An image for the centre (jpg, jpeg, png, gif, webp; max 2MB), sent as multipart/form-data. Read from the request and never written to disk.
  - `logo_path` string: A path returned earlier by POST /me/qr-logo, of the form qr-logos/... Any other path is a 422.

## Response `200`

OK — the image bytes, Content-Type image/svg+xml or image/png

## Other responses

- `401`: No credentials, or credentials that are not valid.
- `403`: Forbidden
- `422`: Validation failed
- `429`: Rate limit exceeded. See `Retry-After`.
- `503`: Unavailable

---

[API](https://skmtc.dev/getdynamicqr/apis/d-qr-rest-api.md) · [All operations](https://skmtc.dev/getdynamicqr/apis/d-qr-rest-api/llms.txt) · [OpenAPI document](https://skmtc.dev/getdynamicqr/apis/d-qr-rest-api/revisions/4467aeca30ce?raw)