Tickets & Passes for WooCommerce

Tickets & Passes adds three product types to WooCommerce: Ticket, Timeslot Ticket and Pass. Customers buy them like anything else in your shop, every purchase issues a QR code, and staff scan that code at the door from a phone browser.

Everything runs on your own site. There is no ticketing service to sign up for, no fee per ticket sold, and no account with anyone else.

Built for venues, attractions, museums, escape rooms, festivals, clubs and anyone who sells admission and then has to let people in.

Three product types

• Ticket – plain admission with a validity window and a set number of uses. Day tickets, entry tickets, gift admission. The customer can pick their own start date within a range you set, or you fix the date yourself.
• Timeslot Ticket – admission for a specific date and time, with a capacity per slot. Generate slots on a repeating schedule instead of building next month by hand. Unpaid reservations are released automatically, so an abandoned checkout never sits on a seat.
• Pass – valid across a period rather than a single visit: season passes, memberships, annual cards. Passes can include guest passes the holder gives away, carry a cardholder photo, and enforce a cooldown between scans.

Check-in at the door

• A scanner page on your own domain, at /check-in/. Full screen, no admin bar, nothing for door staff to get lost in.
• No app to install. Any modern mobile browser works. Where the phone has a native barcode detector the scanner uses it, otherwise it decodes in the page.
• Colour-coded results you choose: valid, already used, expired, on cooldown, or not found.
• Photo check on passes. Staff see the cardholder photo beside the scan result and can compare it with the person in front of them.
• A Scanner user role that grants check-in and nothing else in wp-admin.
• Every decision is made on your server, never on the phone, so a cancelled ticket cannot be waved through by putting the phone in airplane mode.
• A REST check-in API underneath, so a third-party or native scanner app can use the same endpoints.

Running it from wp-admin

• A dashboard per product type – Tickets, Timeslot Tickets and Passes – each with search, manual check-in, resend, reset and cancel.
• Manual check-in for when there is no phone at the door.
• Analytics charting check-in activity by day and by hour, with a CSV export.
• Per-type colours and hint text, so a ticket looks like part of your site rather than part of a plugin.
• Shop Manager friendly. Everything is gated on manage_woocommerce; nobody needs an Administrator account to run the door.

What your customers get

• Tickets and Passes tabs on the standard WooCommerce My Account page.
• The QR code on screen plus a printable PDF download.
• Live status on every ticket – active, used, expired, cancelled or not valid yet – with uses remaining.
• Add to Calendar on timeslot tickets, as a normal .ics file.
• Guest passes handed out from the account page, and a photo upload where a pass asks for one.

Emails

• The WooCommerce order confirmation and completed order emails are extended with ticket, timeslot ticket and pass details.
• Resend Ticket and Resend Pass templates for a re-sent QR code.
• Gifted pass emails: when a buyer enters someone else’s email for a pass, that person receives it. If the address has no account, one is created and they get a link to choose a password.
• Every subject and body is edited in wp-admin and supports merge tags for order and ticket details.

Customer files stay private

QR codes, ticket PDFs and pass photos are not reachable at a guessable public URL. They live in a folder with a random name and are served through the plugin, which checks on every request that the caller holds a signed link from their own email or is signed in as the person the ticket belongs to. Responses are marked private and per-visitor, so a page cache or CDN can never hand one customer’s ticket to the next visitor. Nothing to configure, and it behaves the same on Apache, nginx and IIS.

Privacy

Tickets, timeslot tickets and passes store the holder’s name, and a pass can also store a
cardholder photo and an email used to gift it. Check-in history records the scanning staff member
and when a code was used, not the holder. Gifting a pass to someone else’s email creates them a
customer account if they do not already have one.

The plugin registers a personal data exporter and eraser under Tools > Export/Erase Personal Data.
Erasure anonymises rather than deletes, so check-in history and analytics keep their counts, and a
ticket or pass still valid for an event ahead is retained until it expires.

Nothing to maintain

An hourly background job generates the next batch of recurring timeslots. A per-minute job releases timeslot reservations that were never paid for.

Works with

• WooCommerce HPOS (High-Performance Order Storage) and the block-based cart and checkout.
• Block themes and classic themes.
• Translation ready – every string is translatable, and the plugin ships translations for 25 languages plus a POT file for any other language.
• No build step. All PHP, JavaScript and CSS ships readable and editable.

Requirements

• WooCommerce, installed and active. WordPress will not let the plugin activate without it.
• PHP 8.0 or newer.
• HTTPS, because phone browsers only give camera access to secure pages.

Source Code and Third-Party Libraries

This plugin ships no compiled or obfuscated code. Every PHP, JavaScript and CSS file
written for this plugin is included in readable, editable form, and no build step
(npm, webpack, Composer, etc.) is required to run or modify it.

The following third-party libraries are bundled at the version listed. All are the
upstream distribution files except the Air Datepicker stylesheet, described below:

• dompdf 3.1.6 – PDF rendering – https://github.com/dompdf/dompdf – LGPL-2.1
  (bundled in inc/functions/lib/dompdf/, installed with Composer, together with its
  dependencies dompdf/php-font-lib 1.0.2, dompdf/php-svg-lib 1.0.2, masterminds/html5
  2.10.1, sabberworm/php-css-parser 9.4.0 and thecodingmachine/safe 2.5.0)
• endroid/qr-code 4.8.2 – QR code generation – https://github.com/endroid/qr-code – MIT
  (bundled in inc/functions/lib/qrcodegen/, installed with Composer, together with its
  dependencies bacon/bacon-qr-code 2.0.8 and dasprid/enum 1.0.7)
• jsQR 1.4.0 – QR decoding in the check-in scanner – https://github.com/cozmo/jsQR – Apache-2.0
  (inc/scanner/js/jsqr.js)
• ApexCharts 6.9.0 – charts on the analytics screen – https://github.com/apexcharts/apexcharts.js – MIT
  (inc/analytics-dashboard/lib/apexcharts.min.js)
• Air Datepicker 3.6.0 – date picker for timeslots – https://github.com/t1m0n/air-datepicker – MIT
  (lib/air-datepicker/)

The two Composer-installed libraries can be regenerated from their composer.json with
composer install; the three JavaScript libraries are the unmodified dist files
published by their projects on npm, and their readable sources live in the linked
repositories. The Air Datepicker stylesheet (lib/air-datepicker/css/air-datepicker.css)
is the 3.6.0 dist stylesheet, unminified, with every selector scoped under
.tpfw-datepicker and the unused mobile overlay and global container rules removed;
to regenerate it, take air-datepicker.css from the upstream 3.6.0 dist folder and
prefix its selectors the same way.