At a Denver expo, Maya Chen has one tote left in the first color, a scanner that still chirps, and a tablet that has lost Wi-Fi. An attendee holds up a screenshot from the registration email. The barcode reads, but Maya cannot tell whether it has already been used at the south entrance. She can issue the tote, pause both lines for a connection check, or send the attendee to a staffed desk that can verify the claim. The choice determines whether the next attendee gets the gift they reserved. The comparison applies to the equipment, audience, and inventory your own event can verify.
Start with one rule for every format. A pass is something a guest can present. The pickup system decides whether one gift is still owed, and the handoff record shows whether the guest actually got it. Apple Wallet, a Google Wallet generic pass, and a signed QR printed on paper can all be useful at the same event. They should point to the same underlying entitlement if they are alternatives for the same gift.
Choose the checkout behavior before you choose the pass
Describe one legitimate claim from invitation through handoff. The organizer issues a credential for a particular event and gift entitlement. The scanner reads a barcode. The verifier checks that it belongs to this event, is in its permitted time window, and is currently valid. An inventory system confirms that the desk can fulfill it. An authorized clerk records the physical handoff. If a guest goes to a different desk, the result should be consistent with the first transaction. A device may be able to show a barcode after losing its connection, while the desk still needs a current view of redemption state.
A useful ledger can represent eligible, temporarily reserved, handed over, voided, and pending investigation. Define which transition commits stock and which records physical receipt. One implementation reserves a specific unit briefly after verification and commits the handoff when the clerk confirms it. If the guest walks away or the clerk cancels, the reservation can expire or be released under documented rules. If the screen goes blank after the clerk handed over a gift, recover the original attempt by its unique transaction identifier. Treat an uncertain response as a lookup problem before anyone tries another issue.
The organizer owns the decision about which desks can release which gifts. A ticket provider may issue passes and a supplier may stage merchandise. Those responsibilities can be contracted separately. Write down who controls revocation, who can replace a credential, who can see the redemption record, and who can confirm which desk has stock. Ask each supplier to demonstrate its contribution on your hardware, with an actual event-like test roster. A scanner that works at registration is a useful starting point. It needs its own verification for physical gift pickup.
A scorecard for wallet passes and signed paper
Use the following scorecard to compare the same workflow. Record a proven result, a documented limitation, or an open test next to each cell in the venue's copy. A documented platform feature should get a different mark from a scanner and ledger feature demonstrated together. Evaluate issue, refresh, revocation, weak-network behavior, accessible recovery, duplicate controls, and data exposure on the actual devices planned for the event.
| Question | Apple Wallet pass | Google Wallet generic pass | Signed printed QR |
|---|---|---|---|
| Who can present it? | Guests with a tested compatible Apple device and successfully added pass | Guests with a supported device, account, region, and successfully added pass | Guests with readable paper or access to a staffed print station |
| How is it issued? | Organizer or provider distributes a properly signed pass | Issuer configures the generic pass and tests the intended save flow | Organizer signs an opaque entitlement reference and prints the resulting QR |
| What can change after issue? | A configured update service can refresh supported fields; test delivery and delays | Issuer can update the object; test how changed state appears on the guest device | Paper cannot refresh; revoke or supersede the old reference in the ledger and reissue if needed |
| What can the clerk verify offline? | Only the code and local data supported by the exact scanner and verifier | Only the code and local data supported by the exact scanner and verifier | Authenticity and expiry if the verifier has the right public key and reliable clock; current use remains unknown |
| How can a guest recover? | Open the original distribution channel or use approved assisted lookup | Recover access or use approved assisted lookup on the same entitlement | Look up the original entitlement, invalidate any old copy as required, and reprint under policy |
| What prevents a second handoff? | One shared redemption transaction or a tightly scoped offline allocation | One shared redemption transaction or a tightly scoped offline allocation | The same shared transaction or offline allocation; the signature can survive photocopying |
| What should the barcode expose? | Only data necessary for verification, ideally an opaque reference | Only data necessary for verification, ideally an opaque reference | Only data necessary for verification; anyone can photograph the paper |
Apple Wallet
Apple's Wallet developer overview describes distribution and barcode presentation, including support for common two-dimensional formats and the importance of checking the scanner with the actual device. An optical scanner suitable for phone screens should be part of the venue test. Use the devices and operating system versions you expect guests to bring. Include a watch only if your desk will accept it and the smaller presentation has passed the test. Make the invitation understandable even when someone does not add the pass.
Apple's pass update documentation describes an issuer-side service, device registration, a push notification, and a subsequent fetch of the updated pass. Use it to plan how a visible pickup window or desk label can change. A revoked entitlement needs a server-side decision regardless of what an older device displays. An attendee might see the previous pass after an update is sent. Treat the arrival of an update on the device as something to measure. Test revocation by scanning the superseded credential even if the guest still sees a valid-looking barcode.
Google Wallet
Google's generic pass redemption guide describes barcode scanning and other supported redemption mechanisms. Google Wallet Help distinguishes device and region availability from availability of specific cards and passes. Test the actual generic pass, country settings, account, Android devices, and scanner at this venue. Payment availability on a device is a separate question from whether this particular event pass can be saved and shown. Keep a paper and assisted path open until the eligible device mix is known.
Google's rotating barcode documentation explains how time-based values can make captured barcodes less useful once the value expires. An organizer choosing rotation must implement and test compatible validation, device and verifier time, and failure handling. Rotation does not by itself establish who is entitled, record handoff, or stop two scanners from accepting a still-valid code before either knows what the other has done. A static fallback for the same credential can reduce the protection from rotation. Document when a fallback is issued and how it goes through the same entitlement decision.
Signed paper QR
An organizer can print a QR containing a signed, limited claim reference. Agree what the signature covers with the verifier owner. For an offline-capable design, it may cover an opaque entitlement reference, event, version, expiration, and an identifier for the verification key. Keep the signing key with the issuer. The verifier receives only what it needs to check the signature. The ledger can associate that reference with the minimum attendee details needed for assisted recovery. Names, email addresses, and order details usually do not need to be visible in a barcode that a bystander can photograph.
A signature proves that the signed contents came from an authorized issuer and have not changed, assuming the verifier uses trusted keys and validates correctly. A second print of the same signed QR can still verify. The same applies to a photo of the paper. An offline verifier can check the signed expiration if it has dependable time. It cannot see a revocation or a completed claim at another desk unless it has the relevant state or exclusive authority over that entitlement. Test what the system does with an old print after replacement and after clock drift. Avoid implying that a signed printout is proof of the guest's identity.
Worked decision 1: One offline desk and a copied code
Maya's north desk has lost its connection. At the south desk, a colleague had scanned a pass for the same color of tote minutes earlier. Maya's screen gives no authoritative result for the attendee in front of her. The printed fallback and the attendee's screenshot would lead to the same entitlement reference if they were both legitimately issued. The local scanner decoding the screenshot gives her a way to look up the record. It gives her no basis to release the last tote.
The venue rehearsed two operating modes. In online-only mode all claims must be approved against the shared ledger. When a desk loses access, it can record that someone is waiting and route them to one named help desk with a separate verified connection. No tote leaves the disconnected counter. In a constrained offline mode the supervisor can preassign a small set of entitlements and matching stock to a single desk. Other desks are blocked from issuing those entitlements while the allocation is active. The offline desk has a local spent list, a clock, a short authorized window, and a recorded shift owner. It also has an instruction to pause if its local records are unavailable. Two devices that are disconnected from one another cannot both be given the same unsynchronized allocation.
This event has no verified exclusive allocation for Maya's desk. She stops pickup at that desk and sends the attendee to the help desk, which looks up the entitlement. It finds that the earlier transaction was a reservation that expired without a recorded handoff. The supervisor checks the original desk's stock log and the guest's entitlement before clearing the stale reservation. The help desk then verifies the guest and commits a single handoff. A second attempt using the screenshot is rejected because the ledger now shows an actual issue. If the south desk had recorded a completed handoff, the help desk would open an exception, retain the original transaction, and hold the second gift pending reconciliation. Nobody has to decide from the image alone.
To test that rule before doors open, use one eligible entitlement and two clerks. Try one screenshot at both desks simultaneously, then repeat after disconnecting one tablet and after reconnecting it. Verify that a pending attempt is not later replayed as a fresh issue. Repeat with a genuinely expired code and a guest who has an active claim but cannot show the pass. Log the device, time, entitlement, outcome, and stock delta. Every test should end with a count of what physically moved. A successful scan sound is not a test result.
Worked decision 2: Size the paper and assistance lanes from the queue
A second illustrative expo expects 360 pickup arrivals over 90 minutes, or four arrivals per minute on average. In a rehearsal, most ready passes took 12 seconds each at the normal desks. Assisted lookup, including confirmation and a replacement print when needed, took about 90 seconds. If 10% of attendees need help, that is 36 assisted arrivals over the window. The work is 54 clerk-minutes. One desk can in theory provide 90 clerk-minutes and would average 60% utilization under the smooth-arrival assumption. That tells the team one person can cover the mean. It does not tell them what will happen when a session lets out.
If 15 of the 36 assisted arrivals come in the first ten minutes after a talk, their work totals 22.5 clerk-minutes. One clerk working for ten minutes cannot clear that group in the same interval. Two clerks have 20 minutes of capacity, leaving at least 2.5 clerk-minutes of work if both are continually occupied. The organizer assigns a third trained clerk for that ten-minute peak, giving 30 clerk-minutes of capacity and a modeled margin of 7.5 minutes. Real arrival patterns and changing case lengths can still leave a queue. Test it with the floor layout, the printer, and the time it takes to direct a guest to the right line.
Choose presentation mix after the rehearsal. Let people with a confirmed wallet pass use either staffed pickup lane. Offer a verified preprinted option to people who request one, and put one reprint station behind the assistance desk. Count how many mobile users need to switch, but do not issue a fresh entitlement when they change formats. Suppose a print jam delays replacement by four minutes in the peak. A clerk can still complete approved lookup and record a verified handoff when the ledger and stock are available. If verification is unavailable, record a reservation or waiting record under the event's rules and tell the guest where to return. Do not grant a clerk independent stock just because the printer has stopped.
Reconcile the actual attendance and pickup rates separately at close. A ticket checked at the door may represent someone who opted out of a gift. A verified entitlement may still be waiting for its item. Count physical gifts by SKU and desk, including reserved units, completed handoffs, returns, damages, and unexplained differences. A count from 360 invitations is no substitute for 360 distinct decisions in the ledger.
Make recovery work for guests who have a valid claim
Before the event, put a fallback in the invitation in plain language. Tell guests what they can show, which desk helps if their battery dies, and what details will be asked to find their claim. A guest who needs a screen reader or cannot show a wallet pass should be able to get help without handing over an unlocked phone. Use a staffed lookup with proportionate verification approved for the event. Show only the fields the clerk needs. Avoid collecting a photo of a government ID or sharing a guest roster by default to resolve a routine lookup.
Give supervisors a short list of exceptions. An unreadable code is an assisted lookup. A barcode that belongs to another event is rejected at the verifier. An approved recipient change or lost credential requires invalidation of the old presentation and issuance of a replacement tied to the same entitlement. A duplicate marked handed over becomes a review case. An exhausted SKU becomes an inventory decision under an approved substitution rule. In each case name the person who can act and record the resulting transaction or reservation. When two guests claim the same entitlement, hold the second issue until someone with authority can compare evidence from both desks.
Plan the unplugged window in advance. Some events should use online-only verification and divert to a backup network. Others can allocate a narrow set of low-risk gifts to one offline desk, provided no second desk can serve those same entitlements until the allocation is returned. Pick an expiry and stop condition, reconcile offline records before restoring shared authority, and have a supervisor sign off the stock count. If no such control has been rehearsed, pausing handoff protects both the waiting guest and the remaining gifts.
Put the production and redemption responsibilities in the same brief
A venue test should include bright light, dim screens, low battery, folded paper, stale and replaced passes, simultaneous scans, one disconnected device, and a genuinely valid guest using the manual path. Check whether the exact pass saves on the guest devices and region configuration. Check whether the verifier can see current state and whether it has an approved fallback. Finally confirm how a clerk records the actual transfer and how a replacement event appears in stock. Save the device models and versions, relevant provider documentation, test date, expected behavior, and owner. Recheck platform availability quarterly and on the equipment that will be used at each event.
Assign one owner for issuing and replacing credentials, one for the verification ledger, and one for the actual gifts and their return. If one vendor does all three, ask them to show where the responsibilities meet in a single transaction. If several vendors are involved, test one example from the first invitation to the last inventory record. The organizing team needs to know who can answer the question Maya faced when the scanner chirped and the network disappeared.
Giftpack's marketing and branding offering covers branded merchandise and gifting campaigns. That is useful for planning what arrives, how it is grouped, and what happens to unclaimed stock. Before treating a supplier as part of pass issuance or redemption, verify the specific interface and which system can commit a claim. Your event can still use the wallet and paper formats guests prefer, with one accountable decision about the gift. Maya ultimately handed out the tote only after one verified desk could close the transaction. That outcome is worth testing long before the first line forms.