You have three entrances at your venue. Each entrance needs at least one person with a smartphone to scan tickets. The obvious solution seems to be: create WordPress accounts for everyone and let them log in to the ticket scanner.
In practice, this creates serious problems. Admin or editor access means your staff can accidentally change settings, view customer data, or — in a worst case scenario — create security vulnerabilities if a device gets lost or a temporary worker turns out to be untrustworthy. Even creating minimal WordPress accounts for every part-time door person is administrative overhead you do not need the night before your event.
The better solution is authentication tokens: a URL-based access mechanism that gives staff exactly the access they need — and nothing more.
An authentication token is a unique, hard-to-guess string that grants access to a specific function in your system. Instead of logging in with a username and password, your staff member opens a URL that contains the token. If the token is valid, they get access to the ticket scanner interface — and nothing else.
This approach has several advantages over traditional WordPress accounts:
With the Event Tickets with Ticket Scanner plugin, generating access tokens for your team takes under two minutes. Here is how the workflow looks in practice:
In your WordPress admin panel, go to the Event Tickets menu and find the Auth Tokens section. This is where you manage all scanner access credentials for your team.
Click “Add New Token” and fill in the relevant details:
Once created, the plugin generates a unique URL. This URL contains the auth token embedded directly. Anyone who opens this URL on their smartphone gets immediate access to the scanner interface — no login prompt, no WordPress dashboard, just the scanner.
Copy the URL and share it with your staff member via any messaging app. They bookmark it on their phone and they are ready to go.
From the admin panel, you can see a list of all active tokens and monitor usage. If you need to revoke access — for example, if a staff member finishes their shift — you can deactivate the token with one click. The next time that URL is opened, it will return an access denied message.
For events with multiple entrance points, best practice is to create a separate token for each zone. This gives you granular control and better accountability:
Having separate tokens also helps with post-event analysis. If something goes wrong — a ticket was incorrectly marked as redeemed, for example — you can trace which token was used and at what time.
Your entrance staff does not need any training on WordPress. When they open their access URL, they see a clean, mobile-optimized scanner interface. The camera activates automatically and they point it at the QR code on a ticket. Within one second they get a clear visual and audio confirmation: green for valid, red for invalid or already used.
The interface also supports manual code entry for cases where a QR code cannot be scanned — for example, if a ticket has been printed on low-quality paper and the code is hard to read. Staff can type the ticket code directly.
Token-based access is more secure than shared passwords in most scenarios, but there are a few practices worth following:
WordPress does offer a “Subscriber” role which has minimal permissions, and some plugins allow custom roles. However, even a subscriber account gives someone a login to your WordPress installation. They appear in your user list, they can reset their password, and managing them after the event requires you to delete accounts manually.
Auth tokens require no user account whatsoever. They exist independently of the WordPress user system, they expire automatically, and there is nothing to clean up after your event.
Managing entrance staff access does not have to mean managing WordPress user accounts. With auth tokens, you can have ten people scanning tickets at five different entrances, all without a single WordPress login being shared.
The Event Tickets with Ticket Scanner plugin is available on WordPress.org. The authentication token feature for team access is part of the premium version.