# #024 Calendar QR device registration — v1.0.294

**One ZIP, one installer.** The private server API now provides `POST /pair/create` (admin authorization required) and `POST /pair/redeem` (one-time ticket, same-origin allowed origin only). The server sends SVG QR containing an HTTPS URL with a short-lived ticket in its fragment, **not** the long-lived admin API secret. Ticket lifetime 120 seconds, one redemption only. Endpoint issues random per-device API credentials stored only as SHA-256 hashes in `paired-devices.json` outside DocumentRoot; device browser keeps its own token in origin-scoped localStorage. Backend verifies device ID and token on both upload and download. Re-registration revokes previous token for that device ID. Device ID itself is not a login credential.

On pcsr.net the server admin display area appears. **Admin must input server master key locally first.** Server QR must never be publicly exposed without administrator authentication. Any smartphone/PC can scan the QR with the native phone camera (opens `https://pcsr.net/boneflow/sample/024/calendar/sqlite-merge.html#bf024Pair=<ticket>`); the page erases the fragment from history and redeems it. The page also exposes `カメラでQRを読み取る` if browser BarcodeDetector is supported, or manual code entry. QR is generated on the private server using bundled pure-Python qrcode library; no CDN or third-party service. Private server URL must be publicly accessible over HTTPS to the user's devices. Server master key remains an administrator setup responsibility; server service and Apache proxy are **not** automatically activated by install.

A phone opening pcsr.net is still a *client*, not a server process. Server admin QR display is permission-protected; do not treat `location.hostname` as proof of local administrative access. DBs remain separate by browser origin; clients that pair while on `pcsr.net` access that origin's browser DB. No DB write occurs as part of pairing. Existing backup/merge conflict checks are unchanged. Windows Apache live operation, mobile camera scanning, and real remote end-to-end sync remain **NOT RUN / NOT COMPLETED**.

The Windows private server launcher (`start-server-example.ps1`) generates the 48-byte random administrator secret at first launch and saves it DPAPI-encrypted at `<privateRoot>/server-admin-key.dpapi` (never within the web root); subsequent launches by the same Windows user reload the secret. The key is shown only in the server console for the administrator to enter in `QR表示` on pcsr.net. Do not capture console output in shared logs or screenshots. Browser client credentials are issued separately by pairing, without the administrator key. The service still requires an administrator to configure Apache HTTPS reverse proxy and persistent service startup; the private Python process must be launched on the server host.