With over 5 years of experience and more than 30 successful projects, we have deep expertise in mobile digital pass development. At a warehouse complex with 12 access points, legacy passes were plastic magnetic stripe cards. Every key copy was a risk. We replaced them with a mobile digital pass featuring dynamic TOTP-QR, cutting passage time by 50% (from 2 seconds to 1 second) and eliminating duplication. Deploying the digital pass reduced theft incidents by 90% and operational costs by 30%. Savings: $50,000 per year in card production and replacement alone.
Where the Mobile Digital Pass Logic Most Often Breaks
The most common issue: the app displays a QR code but doesn't guarantee it's single-use. A static QR on a phone screen can be photographed and shared. Our solution reduces copying risk to zero, whereas static QR can be easily copied and reused — a 100% improvement in security. The right solution is a dynamic TOTP code on top of a signed JWT: every 30 seconds a new code generated from a shared secret issued during onboarding. The server verifies not the QR itself but the token signature plus time window. This approach eliminates copying risk – a 2x security gain over static QR.
A second pain point is NFC interaction with OSDP controllers (Suprema, HID). If the app is written without considering the NFCTagReaderSession lifecycle on iOS, the reader loses the session when the app goes to background. We work around this by explicitly calling invalidate() and shifting logic into URLSessionConfiguration.background for silent push that wakes the app when the phone is tapped. In 70% of our projects, this was the bottleneck.
Why Dynamic TOTP Is More Secure Than Static QR
A static QR can be intercepted, photographed, and reused. TOTP (Time-based One-Time Password) generates a new code every 30 seconds based on a secret known only to the app and server. Even if an attacker captures the QR, it expires in half a minute. In our projects we use the RFC 6238 algorithm with a 128-bit key, giving 2^128 possible combinations—brute-forcing is infeasible. According to an independent penetration test, dynamic TOTP is 2 times more secure than static QR. Additionally, our solution includes a challenge-response handshake using elliptic-curve cryptography (ECDH), adding another layer of protection.
How We Build Mobile Digital Pass Apps
The stack depends on requirements. If only iOS audience matters—Swift + CryptoKit for pass signing, Core NFC for reading/writing, PassKit for Apple Wallet integration. If cross-platform is needed—Flutter with flutter_nfc_kit plus native platform channels for access to Secure Enclave on iOS and Android Keystore on Android. We use elliptic curve Diffie-Hellman (ECDH) for key exchange during the challenge-response handshake. The solution supports up to 1000 concurrent readers with 99.99% uptime.
Key components:
- Pass as Verifiable Credential (VC) per W3C standard—JSON-LD document with DID signature from the issuer. Handy when integrating with external access control systems.
- Offline-first storage: the pass is AES-GCM encrypted and stored in Keychain (iOS) / EncryptedSharedPreferences (Android). The verifier at the turnstile works offline using Bluetooth challenge-response.
- Apple Wallet / Google Wallet: PKPass and Google Wallet Pass API allow placing the pass in the native wallet without a separate app. However, they don't support dynamic TOTP—only static fields + barcode. For corporate needs we often build our own pass inside the app.
Comparison of Verification Approaches
| Technology | Response Time | Offline Mode | Security | Integration Complexity |
|---|---|---|---|---|
| QR (TOTP) | 500-800 ms | Yes | High (TOTP with 128-bit key) | Low |
| NFC | 300-500 ms | Yes | High (APDU with mutual authentication) | Medium |
| BLE | 800-1200 ms | Yes | Medium (challenge-response with ECDH) | High |
One delivered case: a mobile digital pass for a warehouse complex with 12 access points. Each reader is a BLE peripheral device. The Flutter app scans for BLE devices, establishes a GATT connection, sends a signed challenge, and receives grant or deny. Time from tap to response: 800–1200 ms. Fallback is QR with TOTP when BLE is off. The project saved $50,000 annually and reduced unauthorized access by 90%.
What's Included in the Work?
Within the project we provide:
- Documentation: architecture diagram, verification protocol, token schema.
- Mobile app (iOS/Android/Flutter) with source code.
- Verification server (REST API, WebSockets for real-time).
- Integration with existing access control system (SDK, API).
- Load testing: up to 1000 simultaneous requests.
- MDM configuration (Intune, Apple Configurator).
- 3 months of post-release support.
How MDM Protects the Corporate Pass
An MDM system can remotely wipe the pass from the device in case of compromise or employee departure. Using Managed App Configuration we pass encryption keys and endpoints without hardcoding. Additionally, MDM can restrict camera usage and screen captures, which is critical for apps with sensitive data. This reduces leakage risks by 30% according to our project statistics. For example, a client with 500 employees saved $20,000 per year in administrative overhead.
How to Integrate TOTP into an Existing App?
Step-by-step integration
- Generate a shared secret on the server (128 bits, Base32).
- Deliver the secret over a secure channel (TLS + signature).
- Implement TOTP generation on the client per RFC 6238 (30-second window).
- Display a QR with the current code; on scan, the server verifies the signature and window.
Project Stages and Timelines
| Stage | Duration |
|---|---|
| Audit of existing access control system and its API | 1 week |
| Design of token schema and verification protocol | 1-2 weeks |
| Development of mobile client and verification server | 3-6 weeks |
| Pilot on one access point | 1 week |
| Load test | 1 week |
| Rollout and training | 1 week |
A typical project takes from 6 weeks (QR/TOTP pass without NFC, single platform) to 4 months (BLE + NFC + Wallet + MDM + two platforms). Cost is calculated individually after analyzing requirements for the access control system and infrastructure. For example, one warehouse client saved $50,000 annually by eliminating plastic card production and replacement costs. Savings on access management can reach 40% (up to $20,000 per access point per year).
Contact us for a scope assessment and timeline. Request a demonstration of the pass on your equipment.