only allow qr_code