QR codes in n8n, Zapier and Make
Three connectors, one account. Make a code a workflow can re-point after it is printed, draw the picture, read one back out of an image, and run something the moment a code is scanned.
The render step, running here
Same renderer the connector calls. Drawn in this browser; nothing is sent or saved.
Show it in
QRSalt → QR Image → Render (Free)
Format
PNG or SVG. JPG, WebP and PDF are on Render, which uses a key.
No account and no credential: this operation calls the public endpoint.
Scan it off the screen
- 27 operations in n8n
- 17 steps in Zapier
- 21 modules in Make
- MIT licensed
On this page
What the connectors do
The same six jobs in all three tools, named the way each tool names things. Everything below is a step you drop into a workflow, not code you write.
Make a code a run can re-point later
A dynamic code arrives with a short link of its own. The step after it can print it, mail it or file it, and the destination behind it stays changeable for as long as the code exists.
Send a printed code somewhere else
Update the destination of a code that is already on a poster, or of five hundred of them in one call. The paper does not change; the next scan goes to the new address.
Draw a picture, with no account
Render text or a link as PNG, SVG, JPG, WebP or PDF, sized in pixels or in millimetres for print. The file comes back as the binary the next step attaches.
Read the code out of a picture
Hand a screenshot or a photo to the decoder and get the text back, with the symbology it was written in. No connection at all on any of the three: the endpoint behind it takes no key.
Start a run the moment somebody scans
A scan, a new code, a re-pointed code or an answered form fires a webhook, and the workflow runs on the event rather than on a timer. Every delivery is signed and the signature is checked before anything else happens.
Keep the housekeeping in the workflow
Folders, tags, UTM presets, scan analytics, QR Menus and QR Form answers are all readable, so a run can file a new code where it belongs instead of leaving it loose.
Underneath all three is the REST API, and the same key works on any of them and on your own scripts at the same time. A connector is a nicer way in, not a second product: nothing here can reach a workspace the key does not belong to.
n8n: a community node and its trigger
A community node with 27 operations across nine resources, plus a separate trigger node listening for five events. The action node is usable as a tool, so an n8n AI Agent can drive it in a sentence.
Available now
Published on npm as n8n-nodes-qrsalt, version 0.1.5, built and signed by a GitHub action so npm carries a provenance statement for the tarball. It has been submitted for n8n verification and the automated package scan passes; it is not a verified node yet, and this page will not call it one until it is.
Installing it
In n8n, Settings → Community nodes → Install, then the package name n8n-nodes-qrsalt. On Cloud and on a self-hosted instance alike, only an instance owner or admin may install one. Self-hosting by hand instead: npm install n8n-nodes-qrsalt in the n8n data folder and restart. Node.js 22 or newer.
Then one credential, QRSalt API: the key, which begins qr_live_ and is shown once when you make it in Dashboard → API, and the base address, which is filled in for you. Saving it calls /api/v1/me, so a key that is wrong is wrong immediately rather than on the first run at three in the morning.
The operations
QR Code — 8
Create, Get, Get Many, Update, Delete, Get Image, Get Scans, and Change Many, which takes up to 500 ids in one call.
QR Image — 3
Render, Render (Free) and Read (Free). The two free ones hide the credential field entirely rather than asking for one they will not use.
Short Link — 2
Create and Get Many. A short link is a dynamic code with the picture left off, so it is re-pointable and counted the same way.
Analytics — 1
Get: scan figures for codes and short links, over the window your plan keeps.
QR Form — 2, QR Menu — 1
List the forms, read the answers to one, and list the menus behind your multi-link codes.
Folder — 5, Tag — 4, UTM Preset — 1
The housekeeping: create, rename, read and delete folders and tags, and list your campaign-tag presets so a run can apply one by name.
The QRSalt Trigger is its own node and carries five events: a code was scanned, created, updated or disabled, and a form was answered. Switching the workflow on is what registers the webhook; switching it off removes it again. Each delivery’s signature is verified before the workflow runs, so a forged POST to your n8n address starts nothing.
A worked example: a print-ready code per row
Google Sheets · Get rows
One row per poster: a title and a destination.
QRSalt · QR Code → Create
Destination from the row, name from the row, kind Dynamic, tagged print-run. The code comes back with a short link of its own.
QRSalt · QR Code → Get Image
Format PDF, width 40 mm — the size the printer asked for, not a pixel count to convert.
Gmail · Send message
The PDF attached, one mail per row, off to the printer.
Because every code in that run is dynamic, the batch that came back from the printer is still editable. The second shipped example is the other half of it: a schedule that finds every code tagged with a campaign and re-points the lot when the campaign ends. The third sends a Slack message on every scan, in two nodes.
All three are workflow files you can import — examples/ in the repository. Make the credential first; an imported node with an empty credential field picks up yours, and from 0.1.4 a QRSalt node with no credential at all fails the step rather than quietly skipping it.
Zapier: an app with nine actions
Nine actions, one search and seven triggers — three that poll and four that fire the moment the thing happens.
Not listed yet
Built and uploaded as version 1.0.1, and private while Zapier’s publishing checks run. It is not in the Zapier app directory, so there is no listing to link to and none is linked. When it is listed, the link appears here.
The steps it adds
Actions — 9
Create QR Code, Create Short Link, Update QR Code, Update Many QR Codes (up to 500 at once), Render QR Code, Read QR Code, Delete QR Code, Delete Folder, Delete Tag.
Search — 1
Find QR Code, by id, by short-link ending or by name — the step that goes in front of an update so a Zap changes the code it meant to.
Polling triggers — 3
New QR Code, New Short Link, New Form Response. Checked on Zapier’s own schedule and deduplicated, so a re-check does not fire twice for the same record.
Instant triggers — 4
New QR Code Scan, New QR Code Created, Updated QR Code, New Form Submission. These are webhooks: the Zap subscribes when you turn it on and unsubscribes when you turn it off.
Authentication is one field, your API key, and the connection is tested against /api/v1/me when you add it. The plan comes back with the workspace name, so the connection lists itself as something like Acme (Free) — which is how you find out you have connected the wrong key before a Zap does.
A worked example: a scan log that fills itself
QRSalt · New QR Code Scan
Instant, not a poll: the Zap runs on the scan, with the code, the short-link ending, the city and the time.
Filter by Zapier · Only continue if…
The tag is this campaign’s, so the trade-show codes do not end up in the shop’s sheet.
Google Sheets · Create Spreadsheet Row
One row per scan, in the sheet the team already has open.
That is a Zap built out of steps the app publishes, written from the app itself — not a screenshot of a published listing, because there is not one to screenshot yet. Reverse the shape and it works as well: a new row in a sheet into Create QR Code, then Render QR Code on the short link that comes back, and the file straight onto an email.
Until the listing opens, the same jobs are done in Zapier with a Webhooks by Zapier custom request and your key in the Authorization header — the API page has the method, address and body for each call.
Make: twenty-one modules
Twenty-one modules: nine actions, four searches, three polling triggers, four instant triggers and the universal call.
Not listed yet
Deployed to Make and private. The Community Apps submission has not been sent, so there is no Make listing and none is linked here. Publishing a Make app cannot be undone, which is why it is not being rushed.
The modules
Actions — 9
Create, Update, Delete and Bulk update QR codes; Create a short link; Render a QR code; Read a QR code; Delete a folder; Delete a tag.
Searches — 4
Search QR codes with filters, and list folders, tags and UTM presets. Each has a Limit, and pagination where the endpoint offers it.
Polling triggers — 3
Watch new QR codes, Watch new short links, Watch new form responses — deduplicated on id and creation date.
Instant triggers — 4
Watch scans, Watch created QR codes, Watch updated QR codes, Watch form submissions. Each registers its own endpoint when the scenario is switched on and removes it when it is switched off.
Universal — 1
Make an API call, for anything the modules do not cover. It takes a relative path only, so it cannot be pointed at another server.
Read a QR code is the one module with no connection at all — the decoder behind it takes no key — so it works in a scenario before you have made one. Everything else shares a single connection, and the key is stripped out of every execution log.
A worked example: the scan reaches the team
QRSalt · Watch scans
An instant trigger. Make gives the scenario an address, the module registers it, and a scan arrives as a bundle.
Router · Two routes
One filtered on the code’s tag, one catching the rest.
Google Sheets · Add a row
The ending, the city and the time, appended as they arrive.
Every module in the app, all twenty-one, has been run against the live API, and each of the four instant triggers has taken a real delivery — a scan by fetching a short link, a creation and an update by changing a code, and a submission by answering a published form. The binary hand-off was proved the awkward way round: render a code, feed the bytes straight into the decoder, and write what came back into the name of a new short link.
Until the app is listed, Make reaches the same API with an HTTP module — Make a request, with the response set to binary when an image is what you want back.
What is free, and what needs a plan
Four tiers, and they are the same four in all three tools. The connectors themselves cost nothing on any platform.
No account at all
Reading a code out of an image, and rendering one in n8n’s Render (Free)
The endpoints behind these take no key. There is an hourly ceiling per caller, and going over it comes back as a refusal that says when it resets.
A key on any plan, Free included
Render: the full picture, every format, sized in pixels or millimetres
Make a key on Free and this works. Nothing is stored, and nothing about the account is read.
Pro, from $39 a month
Everything that touches the account: codes, short links, analytics, forms, menus, folders, tags, presets, and the polling triggers
The same entitlement as the REST API, not a second purchase — a key you already use for a script works here unchanged.
Business, from $99 a month
The instant triggers, in all three tools
They are webhooks, and webhooks are the Business line. A key can pass its connection test, run every action, and still be unable to switch an instant trigger on.
Deleting is a permission, not a tier. The delete box on a key is not ticked when the key is made and is not part of write, so the delete steps in all three connectors refuse until you tick it on purpose. Removing a webhook endpoint when a workflow is switched off needs it too, which is worth knowing before you untick it on the key an instant trigger is using.
Last reviewed , against the product as it works today.
Licensing, and what you agree to
Two separate things, and mixing them up is the usual mistake: the connector has a licence, and the service it talks to has terms.
The connectors are MIT licensed
All three — the n8n node, the Zapier app and the Make app — are published under the MIT licence, and a copy of it ships inside each package. In plain words: you may use, copy, change and redistribute the connector code, including in something you sell, as long as the copyright line and the licence text travel with it — and it is provided as is, with no warranty of any kind. There is no licence key in any of the three, nothing checks one, and installing a connector costs nothing on any of the three platforms.
The n8n node’s source is public, at github.com/QRSalt/n8n-nodes-qrsalt. The Zapier and Make apps carry the same licence in the same words; their source is not published as a repository today.
The service has its own terms
The licence covers the connector, not what it talks to. Every step that carries a key is a request to this service, so an account is governed by the terms of service, the acceptable use policy and the privacy notice, exactly as it is from the dashboard or from a script. A connector adds no term of its own and takes none away.
What a connector sends, and where. Your API key, in an Authorization header, to this service and nowhere else. No telemetry, no analytics call, no third party, and no endpoint belonging to whoever writes the connectors. The forms triggers carry the answers people typed into your own QR Form, which may be data you collected about them; it travels from here to the address your workflow gave us and no further.
So, in one line
Installing a connector means accepting the MIT licence for its code. Using one against an account means accepting the terms above for that account. Those two, and nothing else.
Connector questions, answered
Do I need a connector, or will a plain HTTP step do?
An HTTP step still works and always will — the REST API is the same one underneath. What the connector saves you is the part that is easy to get wrong: the fields are named and typed, your folders and tags arrive as dropdowns rather than ids you have to look up, an image comes back as a file the next step can attach instead of bytes you have to decode, and a refusal arrives as a sentence about what is wrong rather than a status code. The instant triggers are the part an HTTP step cannot do at all, because something has to register and remove the webhook when the workflow is switched on and off.
Is the n8n node verified by n8n?
Not yet, and this page will not pretend otherwise. What is true today: the package is on npm, its tarball carries an attestation anybody can check against the workflow that built it, and n8n’s automated scan of the package passes. What is outstanding is the human half of the review, which wants a demo recording. Verification decides where the node sits in n8n’s own directory. It decides nothing about installing one or running it.
Why can I not find the app in Zapier or Make yet?
Because it is not there. Both are built and both are private while their owners’ checks run — Zapier’s publishing review, and Make’s Community Apps submission, which needs a signed partnership before the form will even send. There is no link on this page to a listing that does not exist. Until they are listed, the same jobs are done in both tools with an HTTP step and your API key.
Can a connector delete my codes by accident?
Only if you hand it a key that may. Deleting is a separate permission on an API key, the Delete box, and it is not ticked when a key is made — it is not part of write, so a key that can change everything still cannot delete anything. On top of that the delete steps ask for the code’s own name or its short-link ending as a confirmation, so a run that has lost track of which record it is on fails rather than removing the wrong one. Make an integration its own key, leave that box alone, and the question stops existing.
Does a connector talk to anything except my account?
No. One credential goes to one host, which is this service, and there is nothing else in any of the three: no telemetry, no licence check, no call home to whoever wrote them. The exception runs the other way — decoding an image asks for no credential whatsoever, so that step runs in a workflow where no connection has been set up at all.
What happens to a live workflow if my plan ends?
Codes keep redirecting — that part of the product does not depend on a subscription. The account steps stop: calls that need Pro start refusing with a sentence naming the plan they want, and webhook deliveries stop with them, so an instant trigger goes quiet rather than firing on stale data. Nothing is deleted and nothing has to be rebuilt; putting the plan back turns the same scenario on again.
Plans behind the connectors
Static codes are free and need no account. The Free plan adds 3 dynamic codes, and paid plans start at $12 a month. Scans are unlimited on every plan.
Free
Free
Unlimited static codes. Three editable ones that never expire.
- Unlimited static QR codes, forever
- 3 editable items in total — dynamic QR codes, QR Menus and QR Forms share them
- Dynamic codes never expire, and each comes with a short link
- Short links on their own, no QR code needed
3dynamic codes
Starter
$12/mo
For one business with codes out in the world.
- 5 QR Menus
- QR Forms
- GS1 Digital Links we host, so a printed pack can be re-pointed
- Advanced tracking and analytics
100dynamic codes
Pro
Most chosen$39/mo
For agencies and teams running codes at scale.
- 50 QR Menus
- Unlimited analytics history
- 10 custom domains
- API access
600dynamic codes
Business
$99/mo
For organisations running codes across many brands.
- 400 QR Menus
- 50 custom domains
- Up to 25 team members and team management
- Up to 10 workspaces
2,000dynamic codes
Unlimited scans on every plan. Cancel online in two clicks. Compare every plan and feature
The rest of the toolbox
Open a row to see the screen and which plan has it.
Custom domains
Short links on your own domain, chosen code by code.Starter and up
Codes open go.yourbrand.com/menu rather than a link with our name in it, so the address under the code is yours. You add two DNS records and we check them. Then pick the domain for each code as you make it, or move a whole list of codes onto it at once.
Starter and up
QR codes on your own domain
Bulk QR code generator
A spreadsheet in, one dynamic code per row out.Starter and up
Paste or upload a list of names and links, match the columns, and get a dynamic code for every row - one per table, stall, badge or product - each with its own scans and destination.
Starter and up
The bulk generator
Change many codes at once
Tick the codes, then pause, tag, file or move them together.Pause and resume on every plan · folders and tags on Starter and up
Tick codes in the list, or pick every code with a tag, and pause or resume them, add or remove tags, move them to a folder or onto your own domain, or add campaign tags, in one go. The API does the same in one request.
Pause and resume on every plan · folders and tags on Starter and up
Short links, with your own ending
The link on its own, for a bio, an email or an ad.Every plan · custom endings on Business
Paste a link and get a short one you can change, route and count, with no QR code unless you want one. Every dynamic code already has its short link beside it, and a short link gets its QR code in one click - the same link, so clicks and scans count together. On Business you choose how the link ends, like /spring-menu, instead of random letters.
Every plan · custom endings on Business
The URL shortener
GS1 Digital Link for products
The retail code that carries your GTIN and still opens a web page.Every plan, Free included
Your domain and the GTIN from under the barcode, with batch, serial and dates if you want them, in the link format GS1 set for retail. A phone opens your page; the product data rides along in the address. The GTIN’s check digit is checked before anything is made.
Every plan, Free included
QR codes for packaging
Wi-Fi, contact cards, email, phone and SMS
Networks, contacts, calendar dates and places, not only links.Every plan, Free included
A website, plain text, a Wi-Fi network, an email, a phone number, a text message, a contact card, a GS1 Digital Link, a PDF, a location, a calendar event and more. Most download free, with no account; the few marked “Editable only” need one.
Every plan, Free included
Contact card codes
PDF codes you can update
Upload a PDF, print the code, swap the file later.Every plan, Free included
We host the file and the code opens it. Upload a new version and the same printed code opens that one, with the old file kept in its history in case you need it back.
Every plan, Free included
PDF to QR code
Your logo in the middle
Upload any image; we size it so the code still scans.Every plan, Free included
PNG, JPEG, WebP or GIF, up to 15 MB - we shrink it ourselves, so nobody has to compress a file first. Error correction goes up to make room, and the logo is never allowed to cover more of the pattern than the code can lose.
Every plan, Free included
Print-ready downloads
PNG and SVG on every plan, and a PDF for the printer.PNG and SVG on every plan · PDF on Starter and up
PNG for screens and quick jobs, SVG for anything that gets scaled, and a print-ready PDF on Starter and up.
PNG and SVG on every plan · PDF on Starter and up
Folders and tags
Keep one location’s or one campaign’s codes together.Starter and up
Put codes in a folder per shop, listing or campaign and filter the list by it. Deleting a folder never deletes a code - they move to No folder, and you can undo it.
Starter and up
Campaign presets
Saved UTM parameters, so printed scans are not “direct”.Starter and up
A printed code arrives in your web analytics as direct traffic. A preset fills in source, medium and campaign in one click, so the flyer and the table tent show up as themselves.
Starter and up
City-level scan locations
Which towns the scans came from, not only which countries.Pro and Business
Scans by city and region for each code, and towns on the live map. Coarse on purpose: the place the phone’s network reports, never a street or a precise position.
Pro and Business
CSV export
Daily scans per code, in a spreadsheet.Pro and Business
Download scans and unique visitors by day for one code or all of them - with each code’s name and short link - as CSV for your own reports, or for whoever asked how the campaign did.
Pro and Business
Webhooks
Your server hears about every scan and every change.Business
Pick the events - a scan, a code made or changed, a form answered, a QR Menu edited - and give us an address. Each one arrives as a signed POST, retried if your server is down, and every delivery is listed with the response it got.
Business
The API and webhooks
Separate workspaces
One subscription, a workspace per brand or client.Business
Each workspace has its own codes, team and analytics, so a client never sees another client’s. Up to 10 under one subscription.
Business
Priority email support
Paid plans’ emails are answered first.Starter and up
A person reads every message. On a paid plan yours is answered before free accounts’ - an order we keep, not a promised hour. Your plan and workspace go along with it, so nobody has to ask which account is yours.
Starter and up
Your data, to take or delete
A full export any time, and deletion you can take back.Every plan, Free included
Download everything - codes, history, scans, form answers and the files you uploaded - as one .zip with spreadsheets inside. Deleting the account gives you 30 days to change your mind, and your printed codes keep working until then.
Every plan, Free included
An API for the codes you print
A REST API for your own code: make dynamic codes and short links, change where they go, render SVG, PNG or PDF, add your domains and change hundreds of codes in one request. No-code tools like Zapier, Make and n8n can call it too, with a plain HTTP step. The API comes with Pro and up, and every request carries your key.
Render a code · Pro and up
curl -o code.svg \
-H "Authorization: Bearer $QRSALT_KEY" \
"https://app.qrsalt.com/api/qr?data=https://example.com"An SVG back, ready for a label, a template or an image tag.
Re-point a printed code · Pro and up
curl -X PATCH https://app.qrsalt.com/api/v1/codes/{id} \
-H "Authorization: Bearer $QRSALT_KEY" \
-H "content-type: application/json" \
-d '{"destination":"https://example.com/winter"}'The printed code opens the new page, and the old one is kept in its history. Keys can only ever touch their own workspace.
Change many codes at once · JavaScript
// Move a campaign's codes onto your own domain
await fetch('https://app.qrsalt.com/api/v1/codes/bulk', {
method: 'POST',
headers: {
authorization: `Bearer ${process.env.QRSALT_KEY}`,
'content-type': 'application/json',
},
body: JSON.stringify({ ids, action: 'domain', domain: 'go.example.com' }),
})Pause, tag, file or move codes in one call. The answer lists what changed and what was skipped.
