QR and NFC

A QR can open the Checkout nextAction.url or identify a service point. Generate the code server-side from the returned URL; do not construct paths or include secrets. NFC can start a proximity interaction, but it does not authenticate content by itself or replace domain and merchant verification.

For either entry surface, validate the HTTPS origin, show the merchant and total from the Checkout session, and let the buyer cancel before authorization. A failed read or expired URL is recovered by retrieving the Payment and obtaining a new authorized action, never by duplicating the sale.

This repository contains no tested result for a particular NFC device or tag. NFC therefore remains Qualification-only; we make no range, distance, hardware-compatibility, or universal-security claim. QR and NFC are entry surfaces, not payment states.