How it works

This demo store sells five kinds of ticket. All of them are issued by a Cloudflare Worker outside TWICE, and all of them arrive as a QR code by email.

The ticket proves itself

A ticket is its own proof. It carries what it grants in plain text — order, dates, type, how many visits — plus a signature made with a secret key only the Worker holds. Checking a ticket means recomputing that signature. Nothing is looked up.

So the database holds no tickets. It holds only the exceptions: which tickets have been used, how many visits each has, and which ones were cancelled. An empty database means “no exceptions”, which is the right default.

Five kinds

Day pass is spent on the first scan. 7-day pass is valid for a week and counts every visit. Open ticket never expires but is good for one visit. 5 visits counts down from five, with no expiry. Year pass is unlimited for twelve months.

The ticket type is one short string on the listing — kerta, jakso/7pv, kerta/aina, jakso:5/aina, jakso/12kk. Adding a sixth kind is one line in the shop, no code change.

The honest limit

A signature proves a ticket is genuine. It can never prove it is unused, and a signed ticket cannot be unsigned — a refunded order's ticket keeps verifying until its own end date unless it is on the revocation list. That is the same trade-off as an offline door lock.

Try it

Buy a ticket, open it from the email, then scan it on the scanner page with your phone. Scan a single-use ticket twice and the second scan tells you it is already used; scan a 5-visit ticket and watch the counter go down. Nothing is charged.