Nova Qrcode Field Laravel Package

Getting Started

Confirm the prerequisite first. This is a Nova field, not a QR library. Laravel Nova must already be installed, licensed, and authenticating via your Composer credentials (auth.json / Nova's private repo). If composer require laravel/nova doesn't work in your environment, this package won't either.

Install.

composer require devtical/nova-qrcode-field

Expect no migrations and no required publish step. If a release ships compiled assets you'll need php artisan nova:publish, but the primary use case (rendering a QR from a value) needs nothing beyond the require.

Verify the namespace before writing any code. With ~46 stars and zero dependents, README drift is a real possibility. Read the source — it's a handful of files:

ls vendor/devtical/nova-qrcode-field/src
head -40 vendor/devtical/nova-qrcode-field/src/*.php

You're looking for three things: the exact class name (QrCode vs Qrcode), the make() signature, and whether the second argument is treated as the attribute to encode rather than an editable column. Nova fields conventionally use Field::make($name, $attribute = null, $resolveCallback = null), but a display-only QR field usually repurposes the second argument as the payload source. That single difference determines how you wire everything up.

First use case — encode an existing column on a detail view:

use Devtical\NovaQrcodeField\QrCode; // confirm against vendor/ source

public function fields(NovaRequest $request)
{
    return [
        ID::make()->sortable(),
        Text::make('Check-in URL', 'checkin_url')
            ->onlyOnForms(),
        QrCode::make('QR Code', 'checkin_url')
            ->onlyOnDetail(),
    ];
}

Then scan it. Not "does it render" — actually point a phone at it and confirm the decoded payload matches the column character-for-character. That one scan validates the whole integration: resolution, payload, rendering path, and CSP behaviour. Watch for trailing whitespace, relative vs. absolute URLs, and APP_URL differing between local and production.

Keep the source field off the detail view (->onlyOnForms() / ->hideFromDetail()) so the raw URL isn't duplicated next to the image unless that's deliberate.

Implementation Patterns

Default posture: detail-only, driven by a real column.

QrCode::make('QR Code', 'share_url')->onlyOnDetail(),

The field is a visual, not an editor. If you find yourself wanting it on a form, you probably actually want the value on the form and the QR on the detail view.

Computed payloads via closures. Signed URLs, rotating tokens, concatenated labels — resolve lazily so nothing is computed for index rows:

QrCode::make('QR Code')
    ->resolveUsing(fn () => URL::signedRoute('checkin', $this->resource))
    ->onlyOnDetail(),

Often cleaner through a model accessor (getQrPayloadAttribute()), which keeps the Nova resource declarative and makes the payload unit-testable and cacheable outside Nova entirely.

Pair it with a copyable text field. QRs are for scanners, not humans. An admin on a laptop with no phone to hand needs the string:

Text::make('Link', 'share_url')->copyable()->exceptOnForms(),
QrCode::make('QR Code', 'share_url')->onlyOnDetail(),

This also gives you something meaningful on the index and detail screens where the QR would otherwise be a lone image.

Dedicated "share" resource. For check-in, onboarding, kiosk, or asset-tag flows, a lightweight ShareResource showing only the QR plus a few read-only fields beats bolting QR panels onto heavy operational resources. Field resolution stays cheap, access control is explicit, and the resource policy is trivially auditable.

Wrap it in a local class. Adoption is thin enough that you want a one-line escape hatch:

namespace App\Nova\Fields;

class QrCode extends \Devtical\NovaQrcodeField\QrCode {}

Now a fork, replacement, or default tuning (size, margin, colour, error correction) is a single edit that propagates across every resource.

Actions for anything that leaves the browser. Don't scrape the rendered image for printing or downloads. Generate the asset yourself in a Nova Action using endroid/qr-code or bacon/bacon-qr-code and stream a download. If on-screen printing is the only need, check whether the field renders SVG (scales cleanly) or a raster (blurs when upscaled) before writing CSS.

Vary the payload per row via actions/modals. Because the payload can be a closure, you can preview a freshly rotated token in an action confirmation before committing. Keep the QR strictly as output of a value computed elsewhere — never let it become the source of truth.

Gotchas and Tips

• Laravel compatibility ≠ Nova compatibility. v2.0.6 added Laravel 12 support; the release note says nothing about Nova majors. Read the laravel/nova constraint in the package's composer.json and test rendering against your actual Nova build. A green composer require proves dependency resolution, not that the field draws.
• Never put it on the index. Nova resolves fields for every row, and QR generation is CPU-bound. Dozens of codes per page is slow and visually noisy. Guard with ->onlyOnDetail() or ->hideFromIndex(). If a thumbnail genuinely matters, cache the encoded output rather than regenerating per request.
• Blank QR = resolution mismatch, not a broken package. The usual culprits, in order: a closure passed where an attribute was expected (or vice versa), the attribute not being selected on the resource query, or the accessor returning null. Debug by dumping the resolved value inside resolve() or by asserting on the accessor in a plain unit test before blaming the field.
• Long payloads fail quietly. URLs with query strings and JSON blobs can exceed QR capacity, especially at higher error-correction levels. If scans fail, shorten the payload — a signed short route, or an opaque ID the scanner resolves server-side — rather than fighting the encoder.
• A QR code is plain text, not encryption. Anyone who photographs the screen has the payload. Never encode API keys, PII, or anything you wouldn't paste into a URL bar. For sensitive flows encode a short-lived signed URL or a one-time token, and think about who can see the admin screen.
• Know whether rendering is client- or server-side. It changes your failure modes entirely: client-side means CSP and asset-pipeline questions (verify it renders under a strict Content-Security-Policy before rollout); server-side means CPU and caching questions.
• Empty box after upgrade = missing assets. Almost always fixed by php artisan nova:publish, not by debugging the package.
• Pin ^2.0, not ^1.0. Recent point releases have been framework-compatibility fixes. Scan the changelog before upgrading, and treat any Laravel or Nova major bump in your app as a trigger to check for a matching package release.
• Budget time for reading the source. Small package, thin docs. Reading src/ is faster than guessing when behaviour and README disagree.
• Test the attribute, not the pixels. In Nova tests or Dusk, assert the underlying value/accessor and the field's presence. Snapshot-testing QR images is brittle. If you truly need to verify decodability, run one focused test that decodes the rendered data URI with a decoder library — no more.