I have thought back of my mind to embed short-lived access token in HTTP header and pass it over url so that everytime when a mobile user scans the ID card (having url encoded string for example http://example.com/api/v1/authenticate) and authenticates the user.
My purpose is to print the QR-Coded ID Card and login the app just by scanning and if authenticated it will automatically take attendance.
Problem is how to make QR Coded ID card to login mobile app? Simply user does not want to take attendance manually and does not want to put password everytime to login app. There is another requirement that app should not be left logged in all the time.