> ## Documentation Index
> Fetch the complete documentation index at: https://docs.neuro-tech.io/llms.txt
> Use this file to discover all available pages before exploring further.

# QR codes and Neuro URI schemes

> Generate QR images and safely route identity, contract, signature, discovery, onboarding, payment, and token links

<Warning>
  Client support and security rules differ by URI scheme. Confirm the scheme, namespace, cryptography, expiry, and one-time-use behavior before generating production links.
</Warning>

A Neuro QR code carries a URI. The QR image has no authority by itself: parse the URI, resolve the responsible domain, show the intended action, and require consent before a signature, transfer, login, claim, or control operation.

## Generate a QR image

```http theme={null}
GET /QR/{url-encoded-text}?w=400&h=400&q=2&fg=Theme&bg=Theme
```

| Parameter   | Default          | Meaning                                                                   |
| ----------- | ---------------- | ------------------------------------------------------------------------- |
| `w`, `h`    | `400`            | Output width and height in pixels.                                        |
| `fg`, `bg`  | `Black`, `White` | Dot/background colors; `Theme` selects current theme colors.              |
| `c`         | Scheme-specific  | Center icon color.                                                        |
| `mc`, `omc` | Derived          | Marker and outer-marker colors.                                           |
| `ac`, `oac` | Derived          | Alignment and outer-alignment colors.                                     |
| `q`         | `1`              | Samples calculated per output pixel for antialiasing. Increase for print. |

Encode the entire text as one path component. Explicitly set high-contrast colors and test with multiple scanners when producing print assets.

## Schemes

| Scheme      | Carries                                                                               |
| ----------- | ------------------------------------------------------------------------------------- |
| `iotid:`    | Legal identity reference (`GUID@trust-provider-domain`).                              |
| `iotsc:`    | Smart contract or template reference, optionally with proposed role/parameter values. |
| `iotdisco:` | Thing-registry discovery and ownership-claim metadata.                                |
| `tagsign:`  | Short-lived request to initiate a signature/Quick Login petition.                     |
| `obinfo:`   | Encrypted onboarding, recovery, or account-transfer locator.                          |
| `edaler:`   | eDaler payment/value-transfer instruction.                                            |
| `nfeat:`    | Neuro-Feature token reference or operation.                                           |
| `aes256:`   | Package-defined encrypted content reference.                                          |

Use the corresponding platform parser/client library. Unknown query parameters must not silently become signed contract values or payment fields.

## Smart contract links

The minimum contract form is:

```text theme={null}
iotsc:CONTRACT_ID@DOMAIN
```

For a template, URI query parameters can propose `Visibility`, a recipient `Role`, known role-to-Legal-ID assignments, and initial parameter values:

```text theme={null}
iotsc:2a746d98-27a9-951f-8816-5dce5960eb0d@legal.example?Visibility=CreatorAndParts&Role=Buyer&Currency=EUR&Value=340
```

Treat every value as an untrusted proposal. Fetch and validate the template, canonicalize typed parameters, render the final human-readable contract, and ask the signer to review it.

## Signature links

`tagsign:{requestor-jid},{base64url-key}` asks a client to start a signature petition. The client sends `<ql xmlns='https://tagroot.io/schema/Signature'>` to the named party; the resulting petition uses the current legal-identity namespace `urn:nf:iot:leg:id:1.0` (legacy peers may advertise the IEEE namespace).

The key is short-lived. Bind approval UI to requestor, purpose, content hash, target endpoint, Legal ID, and expiry. Declining must not create a signature.

## Onboarding links

```text theme={null}
obinfo:DOMAIN:CODE:BASE64_KEY:BASE64_IV
```

The consumer POSTs the code as `text/plain` to `https://DOMAIN/Onboarding/GetInfo` with `Accept: text/plain`, Base64-decodes the response, then decrypts and validates the onboarding XML with the supplied key and IV. Current flows use AES-CBC and PKCS#7 padding; use the platform onboarding implementation because key length and one-time policy depend on the producer.

Partial onboarding can be reusable; full/recovery and transfer payloads are normally one-time and short-lived. An `obinfo` URI is equivalent to a credential—never log, preview, analytics-track, or sync it through an untrusted service.

## Multi-purpose QR package

When the optional MultiQR package is installed, `/MultiQR.md` creates a landing page containing one or more labeled links or embedded media. Definitions can have an expiry, use limit, custom master, color scheme, and counter category. Script packages can call `CreateMultiQR(definition, "/MultiQR.md")` and receive `{ Image, Page }` URLs.

Validate every embedded URL/media type and avoid placing secrets in a multi-purpose page: the page link can be copied even when the original QR was shown privately.