QR labels that prove who owns a device and tell IT where it is

Someone on the client's team had started a device tracker in a low-code app builder. It proved the idea, but the data and the sign-in lived on the builder's proprietary backend, and the asset list was a cramped desktop table when the job happens walking around with a phone. There was also no way for someone who found a device to tell whose it was.

The real need was simple to state. Put a sticker on every company phone, laptop, and monitor. If someone finds one, they scan it and learn it belongs to the company and who has it. Staff scan the same sticker to log where a device is, and manage the whole inventory from their phone.

We removed the low-code layer entirely (its SDK, its sign-in, and its data API) and rebuilt the app on its own dedicated database, with staff sign-in by email and password.

• A public ownership page. Scanning a label opens a page that confirms the device is company property and shows who it is assigned to and where it belongs. No login. It shows only safe fields: no serial number, IMEI, notes, or purchase and warranty dates.
• A staff scanner. A large Scan button in the phone's tab bar opens the camera. A scan checks the device in at a location and writes to a scan log.
• Printable labels. Each device's detail sheet produces a QR label to print or save as an image.
• A mobile-first inventory. Tappable cards on a phone, the full table on a desktop, edit and delete from the detail sheet, and filters by device type.
• Team management. Admins invite staff by email, promote or demote, resend access, and remove people. Nobody can remove or demote themselves.
• Real data only. The sample devices used during the build were wiped and the seed file emptied so demo inventory cannot come back. The design was reworked to drop the template look: one calm color system, with red reserved for devices that are under repair or lost.

The ownership page never reads the inventory tables directly. It calls one database function that returns only the safe fields for a single label. Anonymous visitors cannot read the tables at all.

Admin actions such as inviting or removing a user run in a small server function that holds the powerful database key. The browser never sees that key. The function checks that the caller is an admin before doing anything, and a separate database rule stops anyone but an admin from changing a role, so nobody can promote themselves.

Invite emails ran into the client's email security. The sign-in logs showed a cloud server using up each one-time link about 20 seconds after delivery, before the person clicked it: the company's mail filter was opening every link to check it. The fix moved verification into the page itself. The link now carries a token that the page checks in JavaScript, which mail filters do not run, so the token survives the filter's visit and is only used when a person opens it. A second fix made "send invite" work for someone who already had an account; it used to do nothing for them.

Two camera scanner bugs surfaced in real use. The camera library reports a successful read on every decoded frame, many times a second, so two frames could race to shut the camera off, and with no safety net the whole app went blank. The scanner now acts on the first read only, stops the camera only when it is actually running, and the app has a recovery screen with a reload button instead of a white page. Then scanning a device's own manufacturer barcode came back "no match", because only the ownership label was checked. A scan now tries the label first, then serial number, IMEI, and asset tag, each as an exact match, so odd scanned text cannot break the lookup.

The tracker is live in production. The public ownership check was verified end to end there, called exactly the way a phone scan calls it. Invite and password reset emails send through a verified sending domain, and the filter-proof link is live in the app; the matching email templates are a one-time paste into the sign-in settings.

A found laptop now answers "whose is this?" in one scan. IT has a log of where each device was last checked in, and new staff get access through an emailed invite and set their own password. The newest change, matching on serial number, IMEI, and asset tag, was checked by build and code review, and the next step is a confirmation scan on a real phone.