Skip to content
N1
CRM / Bitrix24 · branch visits · OTP and consents

Registering a client's branch visit: from a QR code to a deal in Bitrix24

Client: Financial company, NDA Category: CRM / Bitrix24 Stack: PHP 8, Bitrix24 REST, JavaScript, SMS gateway, external client-verification services, JSON dictionaries, cron Timeline: rolled out in stages
Problem

A client walking into any of 39 branches has to land in the CRM right away — with a verified phone, consent for a credit bureau inquiry and no duplicates. The client's old applications piled up next to new ones, and the one-time code was generated and checked right in the browser, so verification was a formality.

Constraints

The form opens on a phone via a QR code, the whole branch goes online through a single NAT, and some external checks are paid and unstable — a failure of any external service must not lose the visit.

What I did
  • A bilingual RU/KZ form via QR code: dictionaries of 39 branches and 18 sources, validation of the individual ID (IIN), phone and amount, a car pre-appraisal by make, model and year
  • The contact is found by IIN and phone or created; the client's latest open deal is updated and the rest are moved to the "Duplicate" stage
  • Phone-owner verification, a consent code for the credit bureau inquiry and generation of the consent document; if the service is unavailable — a manual paper-signature branch
  • A server-side one-time code instead of a browser one: valid for 5 minutes, 5 entry attempts, resend no more than once per 60 seconds
  • Handing the client off to the internal credit system fire-and-forget, two-stage accounting of paid requests and an end-to-end visit_request_id across all steps
  • Incident review of July 25, 2026: only 2 of 34 save attempts went through — browsers held old JS cached for 30 days; static assets were versioned and IP limits removed
Architecture
RU/KZ QR form → Checks and consent → Saving the visit → Bitrix24: contact and deal → Credit system (fire-and-forget)
Result

A visit from any branch reaches the CRM with a single form submission: the contact is found or created, duplicate applications are consolidated, and a failure of an external check or the credit system does not lose the client. The save-failure incident was closed the next day, and any visit can now be traced through the logs by a single ID.

What can be reused
Server-side OTP service with TTL, attempt limit and cooldown Static asset versioning by file modification time Two-stage log of paid requests without personal data