Epilogue Online Ticketing & QR Verification System

Selling thousands of concert tickets is only half the problem. The harder half is making sure every ticket that reaches the gate is authentic, issued correctly, and impossible to forge or reuse. For Epilogue '26, MoraSpirit 360 built a complete online ticketing and QR verification system that covers purchase, payment review, e-ticket delivery, and live event-day scanning.

Online ticket reservation form on epilogue.moraspirit.com

At a Glance

Project Overview

The Epilogue ticketing system is a purpose-built operations platform for a large campus music festival. Buyers reserve tickets through a guided online form, upload a bank payment slip, and wait for organizer approval. Once approved, the system generates cryptographically signed QR e-tickets and delivers them by email.

On event day, staff use dedicated mobile web portals — Gate Entrance and Member Verification — to scan tickets in real time. Fake, unissued, or already-used tickets are blocked instantly, with security alerts sent to organizers when fraud patterns appear.

The Challenge

Traditional campus ticket sales often rely on spreadsheets, screenshots of bank transfers, and paper stubs. That approach breaks down when attendance grows into the thousands, when alumni and student tiers need different pricing, and when counterfeit QR images start circulating on social media.

Epilogue needed a system that could:

• Accept online reservations with payment-slip uploads.
• Support Standard, Premium, Alumni, and limited bundle pricing.
• Issue branded e-tickets that are hard to forge.
• Verify tickets at the gate within seconds using phones — not dedicated hardware.
• Prevent double entry while still allowing multi-ticket purchases.
• Give admins a live view of sales, issuance, and scan activity.

The Solution

MoraSpirit 360 designed a full pipeline: public reservation on the festival website, a secure backend for approval and issuance, and browser-based scanners for event day. Every issued ticket carries an HMAC-signed token. Scanners verify the signature before trusting any buyer details, so a copied or edited QR cannot pass as valid.

Buyer Journey

1. Online Reservation

From epilogue.moraspirit.com, buyers open the Ticket Reservation modal and enter name, contact number, email, university index number, batch, faculty, and department. Students choose Standard and/or Premium quantities; Alumni buyers are routed to the Alumni ticket tier automatically.

A live calculated total updates as quantities change. Buyers then upload a payment slip (JPEG, PNG, WEBP, or PDF, max 5MB) before submitting. The backend stores the request, syncs details to Google Sheets, and uploads the slip to Google Drive for finance review.

2. Approval & E-Ticket Issuance

Organizers review pending requests in the Admin Console. After payment confirmation, the system generates a unique ticket ID, creates an HMAC-signed QR token, and renders a branded e-ticket image. Alumni tickets use dedicated Early Bird / Final design templates; general tickets use an SVG template converted to a high-quality image.

Confirmed tickets are emailed to the buyer with the e-ticket attached. Multi-ticket purchases receive individual QR codes (sub-tokens), so each person in a group can be checked in separately.

Alumni e-ticket design with QR placement for gate scanning

3. Event-Day Verification

Two scanner portals handle the door:

• Gate Entrance Portal — verifies authenticity and shows buyer details. Re-scans are logged but do not block soft re-entry checks at the perimeter.
• Member Verification Portal — the strict check-in step. Valid tickets can be marked as entered; duplicate scans are rejected and trigger security alerts.

Gate Entrance Portal — mobile QR scanner UI

Admin Console authentication screen

Key Features

Cryptographic QR Tokens

Each ticket token is signed with HMAC-SHA256. Scanners reject any QR whose signature does not match, even if the ticket ID looks plausible. Timing-safe comparison protects against simple timing attacks.

Anti-Fraud & Duplicate Protection

Fake tickets, unissued tickets, and already-checked-in sub-tokens return clear statuses to staff. Critical cases — forged QRs and duplicate entry attempts — dispatch real-time security alert emails with scanner name, buyer details, and timestamps.

Admin Operations Console

A PIN-protected dashboard lets organizers sync from Google Sheets, trigger backups, test SMTP, monitor ticket counts, and manage issuance. The admin surface is intentionally separated onto ticket.moraspirit.com so public marketing traffic and operations traffic stay cleanly split.

Premium Bundle Offers

Limited Premium bundles (5 tickets at a discounted package price, capped inventory) were tracked server-side. Bundle availability and sell-out state could be exposed to the website so marketing components appear and disappear automatically as inventory changes.

System Architecture

The backend is a Node.js / Express service with SQLite for ticket state, scan logs, and operational ledgers. Supporting services handle QR generation, e-ticket rendering (Sharp), SMTP delivery (Nodemailer), and Google Sheets / Drive sync for finance and backup workflows.

Static festival marketing content is served from epilogue.moraspirit.com. Scanner and admin routes on that host redirect to ticket.moraspirit.com, keeping verification tools on a dedicated operations domain.

Technology Stack

Technical Highlights

• End-to-end flow from payment slip upload to emailed e-ticket
• HMAC-signed QR codes with high error-correction for print/phone glare
• Separate Gate and Member scanner roles for perimeter vs check-in
• Sub-token support for multi-ticket purchases
• Real-time fake/duplicate security email alerts
• Google Sheets sync and Drive slip archival for finance teams
• Domain split between marketing site and operations scanners
• Rate-limited scan endpoints for event-day traffic spikes

Outcome

The Epilogue ticketing stack gave MoraSpirit 360 a reliable way to sell and verify festival tickets without paper stubs or fragile spreadsheet workflows. Buyers received branded digital tickets; door staff verified authenticity in seconds; and organizers retained a clear audit trail from payment to entry.

Together with the public festival website, the system formed the operational backbone of Epilogue '26 — connecting excitement online to a controlled, trustworthy experience at the gate.

About MoraSpirit

Founded in 2009 by University of Moratuwa undergraduates, MoraSpirit began as a university sports media platform and has grown into a student-run initiative behind events, campaigns, and digital products across the university — Epilogue among them. MoraSpirit 360 continues that work by engineering the digital systems that make large campus experiences possible.